An uncommon file was created in the startup folder

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	7 Days
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules
Detector Tags
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001)
Severity	Informational

Description

An uncommon file was created in the startup folder.

Attacker's Goals

Persistence on the host.

Investigative actions

Check if the file was written during an installation of a legitimate application (what other files that were written by the process).
Check what program opens this file by the extension - Check the registry at HKEY_CLASSES_ROOT.[extension]\shell\[action]\command for the default application or command to execute.

Variations

An executable file with a non-default extension was added to the startup folder

Synopsis

ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001)
Severity	Medium

Description

An executable file with a non-default extension was added to the startup folder.

Attacker's Goals

Persistence on the host.

Investigative actions

Check if the file was written during an installation of a legitimate application (what other files that were written by the process).
Check what program opens this file by the extension - Check the registry at HKEY_CLASSES_ROOT.[extension]\shell\[action]\command for the default application or command to execute.

An executable or script was added to the startup folder

Synopsis

ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001)
Severity	Low

Description

An executable or script was added to the startup folder, which may happen on new program installation, but may also indicate a malicious program persisting itself.

Attacker's Goals

Persistence on the host.

Investigative actions

Check if the file was written during an installation of a legitimate application (what other files that were written by the process).
Check what program opens this file by the extension - Check the registry at HKEY_CLASSES_ROOT.[extension]\shell\[action]\command for the default application or command to execute.

A file with an uncommon extension was added to the startup folder

Synopsis

ATT&CK Tactic

Persistence (TA0003)

ATT&CK Technique

Severity

Low

Description

A file with an uncommon extension was added to the startup folder, which may happen on new program installation, but may also indicate a malicious program persisting itself.

Attacker's Goals

Persistence on the host.

Investigative actions

Check if the file was set during installation process (what other files were written by the process).
Check the registry at HKEY_CLASSES_ROOT.[extension]\shell\[action]\command for the default application or command to execute.

A new shortcut (lnk) was added to the startup folder

Synopsis

ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001)
Severity	Low

Description

A new shortcut (lnk) file was added to the startup folder, which may happen on new program installation, but may also indicate a malicious program persisting itself.

Attacker's Goals

Persistence on the host.

Investigative actions

Check if the file was written during an installation of a legitimate application (what other files that were written by the process).
Check what program opens this file by the extension - Check the registry at HKEY_CLASSES_ROOT.[extension]\shell\[action]\command for the default application or command to execute.