Suspicious Startup shell folder modification

Detects when adversaries attempt to modify the default Startup folder path to to circumvent runtime rules that hunt for file creations in the default Startup folder.

• Platform: Windows
• Severity: High
• MITRE Tactic: Persistence
• MITRE Techniques: T1547, T1547.001

Back to all rules