Persistent Scripts in the Startup Directory

edit

Identifies script engines creating files in the startup folder, or the creation of script files in the startup folder.

Rule type: eql

Rule indices:

  • winlogbeat-*
  • logs-endpoint.events.*

Severity: medium

Risk score: 47

Runs every: 5 minutes

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

Tags:

  • Elastic
  • Host
  • Windows
  • Threat Detection
  • Persistence

Version: 2 (version history)

Added (Elastic Stack release): 7.11.0

Last modified (Elastic Stack release): 7.11.2

Rule authors: Elastic

Rule license: Elastic License

Rule query

edit
file where event.type != "deletion" and user.domain != "NT AUTHORITY"
and /* detect shortcuts created by wscript.exe or cscript.exe */
(file.path : "C:\\*\\Programs\\Startup\\*.lnk" and process.name :
("wscript.exe", "cscript.exe")) or /* detect vbs or js files
created by any process */ file.path :
("C:\\*\\Programs\\Startup\\*.vbs",
"C:\\*\\Programs\\Startup\\*.vbe",
"C:\\*\\Programs\\Startup\\*.wsh",
"C:\\*\\Programs\\Startup\\*.wsf",
"C:\\*\\Programs\\Startup\\*.js")

Threat mapping

edit

Framework: MITRE ATT&CKTM

Rule version history

edit
Version 2 (7.11.2 release)
  • Formatting only