Potential Startup Shortcut Persistence Via PowerShell.EXE
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects PowerShell writing startup shortcuts. This procedure was highlighted in Red Canary Intel Insights Oct. 2021, "We frequently observe adversaries using PowerShell to write malicious .lnk files into the startup directory to establish persistence. Accordingly, this detection opportunity is likely to identify persistence mechanisms in multiple threats. In the context of Yellow Cockatoo, this persistence mechanism eventually launches the command-line script that leads to the installation of a malicious DLL"
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "File Created or Modified" AND PROCESSNAME endswith "\powershell.exe,\pwsh.exe" AND (FILENAME contains "\start menu\programs\startup" OR OBJECTNAME contains "\start menu\programs\startup") AND (FILENAME endswith ".lnk" OR OBJECTNAME endswith ".lnk") select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.DOMAIN,Action1.OBJECTNAME,Action1.FILENAME,Action1.PROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Christopher Peacock '@securepeacock', SCYTHE
