Hunting For Startup Folder Persistence

Hunting for Startup Folder Persistence

Overview

Attackers use Windows startup folders for persistence (MITRE ATT&CK T1547.001 — Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder). Files placed in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup or C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup execute automatically at user logon. This skill scans startup directories for suspicious files, monitors for real-time changes using Python watchdog, and analyzes file metadata to detect persistence implants.

When to Use

Trigger phrases:

• "hunting for startup folder persistence"

• "Detect T1547"

• When investigating security incidents that require hunting for startup folder persistence

• When building detection rules or threat hunting queries for this domain

• When SOC analysts need structured procedures for this analysis type

• When validating security monitoring coverage for related attack techniques

Prerequisites

• Python 3.9+ with watchdog, pefile (optional for PE analysis)
• Access to Windows startup folders (user and all-users)
• Windows Event Logs for Event ID 4663 correlation (optional)

Steps

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}

1. Enumerate all files in user and system startup directories
2. Analyze file types, creation timestamps, and digital signatures
3. Flag suspicious file extensions (.bat, .vbs, .ps1, .lnk, .exe)
4. Check for recently created files (< 7 days) as potential implants
5. Monitor startup folders in real-time using watchdog FileSystemEventHandler
6. Correlate with known legitimate startup entries
7. Generate threat hunting report with T1547.001 MITRE mapping

Expected Output

• JSON report listing all startup folder contents with risk scores, file metadata, and suspicious indicators
• Real-time monitoring alerts for new file creation in startup directories

When NOT to Use

• You're responding to a known incident (use IR skills)
• Task is about analyzing confirmed malware (use analyzing-* skills)
• You need to implement detection rules (use implementing-* skills)
• Task is about vulnerability scanning (use scanning tools)
• You don't have access to endpoint/network data
• Task requires compliance auditing (use auditing-* skills)

Red Flags

• Performing actions without explicit written authorization from the asset owner
• Testing against production systems without a defined scope and rules of engagement
• Acting on threat intelligence without validating source reliability
• Sharing classified or sensitive indicators without proper handling procedures
• Alerting threat actors to detection capabilities through visible response actions

Process

1. Reconnaissance — Gather target information, identify attack surface, enumerate services
2. Analysis/Exploitation — Execute the technique, analyze results, document findings
3. Reporting — Document IOCs, write findings, provide remediation recommendations

Verification

• All steps executed successfully against a test environment before production use
• Output documented with screenshots or logs demonstrating expected behavior
• Results validated against known-good baselines or reference implementations
• Documentation complete enough for another analyst to reproduce findings

Anti-Rationalization Table