Detection rules › Splunk
File Written to Startup Folder - Windows (Windows Event Log)
Adversaries may achieve persistence by adding a program to a startup folder. Adding an entry to the startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level. This use case detects file writes to \Microsoft\Windows\Start Menu\Programs\StartUp.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | |
| Privilege Escalation |
References
- https://www.uptycs.com/blog/cryptocurrency-entities-at-risk-threat-actor-uses-parallax-rat-for-infiltration
- https://attack.mitre.org/techniques/T1547/001/
- https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/file/file_event/file_event_win_startup_folder_file_write.yml
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4656: A handle to an object was requested. |
Rule body
id: '29486.53151'
title: File Written to Startup Folder - Windows
description: Adversaries may achieve persistence by adding a program to a startup
folder. Adding an entry to the startup folder will cause the program referenced
to be executed when a user logs in. These programs will be executed under the context
of the user and will have the account's associated permissions level. This use case
detects file writes to \Microsoft\Windows\Start Menu\Programs\StartUp.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4656) OR
"<EventID>4656<") "%%4417") "Microsoft\\Windows\\Start Menu\\Programs\\Startup\\"
| where !match(process_name, "(?i)wuauclt\.exe") and !match(ObjectName, "(?i)C:\x5c\$Windows\.~BT\x5cNewOS\x5c")
| table _time, host, user, process, process_name, process_exec, ObjectName | bin
span=1s | stats values(*) as * by _time, host '
techniques:
- persistence:boot or logon autostart execution:registry run keys / startup folder
technique_id:
- T1547.001
data_category:
- Windows event logs
references:
- https://www.uptycs.com/blog/cryptocurrency-entities-at-risk-threat-actor-uses-parallax-rat-for-infiltration
- https://attack.mitre.org/techniques/T1547/001/
- https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/file/file_event/file_event_win_startup_folder_file_write.yml
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4656) OR "<EventID>4656<") "%%4417") "Microsoft\\Windows\\Start Menu\\Programs\\Startup\\"
Stage 2: where
| where !match(process_name, "(?i)wuauclt\.exe") and !match(ObjectName, "(?i)C:\x5c\$Windows\.~BT\x5cNewOS\x5c")
Stage 3: table
| table _time, host, user, process, process_name, process_exec, ObjectName
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
ObjectName | regex_match | "(?i)C:\x5c$Windows.~BT\x5cNewOS\x5c" | excludes:ObjectName |
process_name | regex_match | "(?i)wuauclt.exe" | excludes:process_name |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq value:"4656" |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "<EventID>4656<" |
| 1 | "%%4417" |
| 1 | "Microsoft\\Windows\\Start Menu\\Programs\\Startup\\" |