Techniques
Sample rules
Startup Folder File Write
- source: sigma
- technicques:
- t1547
- t1547.001
Description
A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.
Detection logic
condition: selection and not filter_update
filter_update:
- Image: C:\Windows\System32\wuauclt.exe
- TargetFilename|startswith: C:\$WINDOWS.~BT\NewOS\
selection:
TargetFilename|contains: \Microsoft\Windows\Start Menu\Programs\StartUp