Windows: Suspicious HTA Startup Folder Creation by FoxitPDFReader.exe

Alerts on FoxitPDFReader.exe creating .hta files in the Startup Programs folder, which can indicate persistence.

FreeReviewedSigma · High · v5

Product: windows
Category: file_event
Author: Gregory (SigmaHQ), DRL 1.1
Published: 2023-10-11
Updated: 2026-07-31

ATT&CK techniques

Persistence

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1505.001SQL Stored Procedures
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags file creation events where FoxitPDFReader.exe creates a .hta file within the current user's Startup folder path under the Start Menu. Creating script files in Startup locations can provide persistence by executing content on user logon. It relies on Windows file event telemetry capturing the creating process image and the target filename/path.

Reporting behind it

Related detections6 linkedT1505.001 — drag to rearrange

Malicious SQL Server Lateral Movement with CLR Activation (via application)

Malicious SQL Server Dedicated Admin Connection (DAC) Suspicious Activity (via application)

Malicious SQL Server Sqlcmd Utility Abuse for Privilege Escalation (via process_creation)

Malicious SQL Server Dedicated Admin Connection (DAC) Mode Activated - Native (via application)

Malicious Command Shell Spawned by SQL Server via xp_cmdshell

Database SQL keyword matching suspicious queries (DROP/TRUNCATE/DUMP/SELECT *)

Windows: Suspicious HTA Startup Folder Creation by FoxitPDFReader.exe

Pivot detection · T1505.001 · 6 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-suspicious-hta-file-creation-in-startup-folder-by-foxitpdfreader-exe-9cae055f

title: "Windows: Suspicious HTA Startup Folder Creation by FoxitPDFReader.exe"
id: e14914da-dc55-4151-a19c-e5436905f2ff
status: test
description: This rule flags file creation events where FoxitPDFReader.exe creates a .hta file within the current user's Startup folder path under the Start Menu. Creating script files in Startup locations can provide persistence by executing content on user logon. It relies on Windows file event telemetry capturing the creating process image and the target filename/path.
references:
  - https://github.com/j00sean/SecBugs/tree/ff72d553f75d93e1a0652830c0f74a71b3f19c46/CVEs/CVE-2023-27363
  - https://www.zerodayinitiative.com/advisories/ZDI-23-491/
  - https://www.tarlogic.com/blog/cve-2023-27363-foxit-reader/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-27363/file_event_win_cve_2023_27363_foxit_rce.yml
author: Gregory, Huntrule Team
date: 2023-10-11
tags:
  - attack.persistence
  - attack.t1505.001
  - cve.2023-27363
  - detection.emerging-threats
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith: \FoxitPDFReader.exe
    TargetFilename|contains: \Microsoft\Windows\Start Menu\Programs\Startup\
    TargetFilename|endswith: .hta
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 9cae055f-e1d2-4f81-b8a5-1986a68cdd84
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL