Script File Written to Startup Folder

[rule]
description = """
Identifies suspicious Windows script file extensions written to the startup folder. Adversaries may use this technique
to maintain persistence.
"""
id = "dec8781c-ef73-4037-9684-ef28c0322fa4"
license = "Elastic License v2"
name = "Script File Written to Startup Folder"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/doing-time-with-the-yipphb-dropper"]
version = "1.0.37"

query = '''
file where event.action != "deletion" and process.name != null and
  file.extension : ("js", "vbs", "jar") and file.name != null and user.id : ("S-1-5-21*", "S-1-12-*") and
  file.path : ("?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*",
               "?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\*") and
  not process.code_signature.trusted == true and
  not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe")
'''

min_endpoint_version = "8.0.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"
[[threat.technique.subtechnique]]
id = "T1547.001"
name = "Registry Run Keys / Startup Folder"
reference = "https://attack.mitre.org/techniques/T1547/001/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.0.0"