Sigma rule: Potential Startup Shortcut Persistence Via PowerShell.EXE

Rule

Title

Potential Startup Shortcut Persistence Via PowerShell.EXE

Status

test

Level

high

Author

Christopher Peacock '@securepeacock', SCYTHE

Date

2021-10-24

Modified

2023-02-23

File

rules/windows/file/file_event/file_event_win_powershell_startup_shortcuts.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects PowerShell writing startup shortcuts.
This procedure was highlighted in Red Canary Intel Insights Oct. 2021, "We frequently observe adversaries using PowerShell to write malicious .lnk files into the startup directory to establish persistence.
Accordingly, this detection opportunity is likely to identify persistence mechanisms in multiple threats.
In the context of Yellow Cockatoo, this persistence mechanism eventually launches the command-line script that leads to the installation of a malicious DLL"

Log source

product

windows

category

file_event

Detection

selection:
    Image|endswith:
        - '\powershell.exe'
        - '\pwsh.exe'
    TargetFilename|contains: '\start menu\programs\startup\'
    TargetFilename|endswith: '.lnk'
condition: selection

False positives (as the rule lists them)

• Depending on your environment accepted applications may leverage this at times. It is recommended to search for anomalies inidicative of malware.

Tags

• attack.privilege-escalation
• attack.persistence
• attack.t1547.001

MITRE ATT&CK ids this rule names

• T1547.001

References

• https://redcanary.com/blog/intelligence-insights-october-2021/
• https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1547.001/T1547.001.md#atomic-test-7---add-executable-shortcut-link-to-user-startup-folder

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_powershell_startup_shortcuts.yml