Manipulation of autostart related system files

BIOC Informational

Manipulation of autostart related system files

May be used as a malware persistence technique, as these files have relevancy to the startup routine of Windows.

Module:: Platform Analytics
Agent event type:: File
Category:: Persistence
Status:: Enabled

ATT&CK tactics: Persistence (TA0003)

ATT&CK techniques: Pre-OS Boot: Bootkit (T1542.003)

Indicator:

File action type = create , delete , write AND file name = system.ini , win.ini , wininit.ini , winstart.bat , autoexec.bat , config.sys , system autoexec.nt , system config.nt , dosstart.bat Process initiated by != wuauclt.exe AND cgo name != wuauclt.exe

Preventable: yes