Network connection via startup folder executable or script

Identifies the execution of unsigned binary or script from the Startup folder followed by network inbound or outbound connection.

• Platform: Windows
• Severity: High
• MITRE Tactic: Persistence
• MITRE Techniques: T1547, T1547.001

Back to all rules