Windows: Suspicious HTA Startup Folder Creation by FoxitPDFReader.exe
Alerts on FoxitPDFReader.exe creating .hta files in the Startup Programs folder, which can indicate persistence.
- Product
- windows
- Category
- file_event
- Author
- Gregory (SigmaHQ), DRL 1.1
- Published
- 2023-10-11
- Updated
- 2026-07-31
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags file creation events where FoxitPDFReader.exe creates a .hta file within the current user's Startup folder path under the Start Menu. Creating script files in Startup locations can provide persistence by executing content on user logon. It relies on Windows file event telemetry capturing the creating process image and the target filename/path.
Reporting behind it
- github.comhttps://github.com/j00sean/SecBugs/tree/ff72d553f75d93e1a0652830c0f74a71b3f19c46/CVEs/CVE-2023-27363
- zerodayinitiative.comhttps://www.zerodayinitiative.com/advisories/ZDI-23-491/
- tarlogic.comhttps://www.tarlogic.com/blog/cve-2023-27363-foxit-reader/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-27363/file_event_win_cve_2023_27363_foxit_rce.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Suspicious HTA Startup Folder Creation by FoxitPDFReader.exe"
id: e14914da-dc55-4151-a19c-e5436905f2ff
status: test
description: This rule flags file creation events where FoxitPDFReader.exe creates a .hta file within the current user's Startup folder path under the Start Menu. Creating script files in Startup locations can provide persistence by executing content on user logon. It relies on Windows file event telemetry capturing the creating process image and the target filename/path.
references:
- https://github.com/j00sean/SecBugs/tree/ff72d553f75d93e1a0652830c0f74a71b3f19c46/CVEs/CVE-2023-27363
- https://www.zerodayinitiative.com/advisories/ZDI-23-491/
- https://www.tarlogic.com/blog/cve-2023-27363-foxit-reader/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-27363/file_event_win_cve_2023_27363_foxit_rce.yml
author: Gregory, Huntrule Team
date: 2023-10-11
tags:
- attack.persistence
- attack.t1505.001
- cve.2023-27363
- detection.emerging-threats
logsource:
product: windows
category: file_event
detection:
selection:
Image|endswith: \FoxitPDFReader.exe
TargetFilename|contains: \Microsoft\Windows\Start Menu\Programs\Startup\
TargetFilename|endswith: .hta
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 9cae055f-e1d2-4f81-b8a5-1986a68cdd84
type: derived