Startup folder executable write
An executable or script was written into a Startup folder.
What it detects
An executable or script was written into a Startup folder. Everything there runs at the next interactive logon, with the user's rights and no prompt — the oldest and still one of the most common persistence mechanisms, because it needs no elevation and no registry access.
Both scopes are covered: the per-user folder under AppData\Roaming, and the all-users folder under ProgramData, which starts the payload for every account that logs on and normally requires administrative rights to write.
MITRE ATT&CK mapping
- T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder· Persistence
False positives and triage
Installers legitimately place shortcuts here, so .lnk writes are common and low-signal on their own; a .exe, .scr or a script written directly into the folder is much rarer and worth immediate attention.
To confirm: the writing process is the first question. explorer.exe means a user dropped it in, an installer means a genuine setup, and mstsc.exe, a script host, or a process in a temp directory means it was planted. For a .lnk, read its target — the shortcut is often benign-looking while pointing at a payload elsewhere. Check the all-users folder against the per-user one: an attacker choosing the machine-wide path had administrative rights already.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 75%. Source: rules/windows/startup_folder_executable_write.yaml, licensed under the Apache License 2.0.
id: windows.persistence.startup_folder_executable_write
version: 1.0.0
status: stable
severity: high
confidence: 0.75
platforms: [windows]
mitre_techniques: [T1547.001]
description: |
An executable or script was written into a Startup folder. Everything there runs at
the next interactive logon, with the user's rights and no prompt — the oldest and
still one of the most common persistence mechanisms, because it needs no elevation
and no registry access.
Both scopes are covered: the per-user folder under `AppData\Roaming`, and the
all-users folder under `ProgramData`, which starts the payload for every account
that logs on and normally requires administrative rights to write.
match:
file_path_regex: '(?i)\\start menu\\programs\\startup\\[^\\]+\.(exe|dll|scr|bat|cmd|ps1|vbs|js|jse|wsf|hta|lnk|jar|pif)$'
correlation_keys: [hostname, user_name]
false_positive_guidance: |
Installers legitimately place shortcuts here, so `.lnk` writes are common and
low-signal on their own; a `.exe`, `.scr` or a script written directly into the
folder is much rarer and worth immediate attention.
To confirm: the writing process is the first question. `explorer.exe` means a user
dropped it in, an installer means a genuine setup, and `mstsc.exe`, a script host,
or a process in a temp directory means it was planted. For a `.lnk`, read its
target — the shortcut is often benign-looking while pointing at a payload
elsewhere. Check the all-users folder against the per-user one: an attacker
choosing the machine-wide path had administrative rights already.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.