Analytics BIOC
Informational
✕
An uncommon file was created in the startup folder
An uncommon file was created in the startup folder.
- Module:
- Platform Analytics
- Data source:
- XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001)
Attacker's goals:
Maintain persistence on the host through automatic execution at startup.
Investigative actions:
Determine if the file was created as part of a legitimate application installation, and check other files written by the same process. Identify which program opens this file based on its extension. Check the registry at HKEY_CLASSES_ROOT[extension]\shell[action]\command to see the default application or command used to execute the file.
- Test period:
- N/A (single event)
- Deduplication:
- 7 Days
4 variations:
- An executable file with a non-default extension was added to the startup folder Medium (parent: Informational)
- An executable or script was added to the startup folder Low (parent: Informational)
- A file with an uncommon extension was added to the startup folder Low (parent: Informational) Adds Event Triggered Execution: Change Default File Association (T1546.001)
- A new shortcut (lnk) was added to the startup folder Low (parent: Informational)