Sigma rule: Suspicious Startup Folder Persistence

Rule

Title

Suspicious Startup Folder Persistence

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2022-08-10

Modified

2025-10-12

File

rules/windows/file/file_event/file_event_win_susp_startup_folder_persistence.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common persistence technique used by threat actors.
These files (.ps1, .vbs, .js, .bat, etc.) are automatically executed when a user logs in, making the Startup folder an attractive target for attackers.
This technique is frequently observed in malvertising campaigns and malware distribution where attackers attempt to maintain long-term access to compromised systems.

Log source

product

windows

category

file_event

Detection

selection:
    TargetFilename|contains: '\Windows\Start Menu\Programs\Startup\'
    TargetFilename|endswith:
        # Add or remove suspicious extensions according to your env needs
        - '.bat'
        - '.cmd'
        - '.dll'
        - '.hta'
        - '.jar'
        - '.js'
        - '.jse'
        - '.msi'
        - '.ps1'
        - '.psd1'
        - '.psm1'
        - '.scr'
        - '.url'
        - '.vba'
        - '.vbe'
        - '.vbs'
        - '.wsf'
condition: selection

False positives (as the rule lists them)

• Rare legitimate usage of some of the extensions mentioned in the rule

Tags

• attack.privilege-escalation
• attack.execution
• attack.t1204.002
• attack.persistence
• attack.t1547.001

MITRE ATT&CK ids this rule names

• T1204.002
• T1547.001

Related rules

• 2aa0a6b4-a865-495b-ab51-c28249537b75 (similar)

References

• https://github.com/last-byte/PersistenceSniper
• https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/
• https://github.com/redcanaryco/atomic-red-team/blob/5ede8f21e42ebe37e0a6eff757dba60bcfa85859/atomics/T1547.001/T1547.001.md

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_susp_startup_folder_persistence.yml