Suspicious Shortcut and File Creation in Windows Startup Directories¶
This detection identifies file creation events within common Windows startup directories and enriches them with Windows Shell Link (shortcut) creation activity. Startup folders are frequently abused by adversaries for persistence since files or shortcuts placed here automatically execute at user login. The query covers both system-wide and user-specific startup paths and can exclude known legitimate items via an exclusion list to reduce false positives.
Detection details
| Tactic | Technique | Author | Date |
|---|---|---|---|
| Persistence | T1547.009, Boot or Logon Autostart Execution: Shortcut Modification | Rory Wagner (Sleuthifer) | 2025-08-29 |
References
Placeholders to tune
exclusionList is a placeholder list. Fill in known-good values from your environment before you deploy this query.
Query¶
// Set the full paths for startup items
let startupFullPaths = dynamic([
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp",
"C:\\Documents And Settings\\All Users\\Start Menu\\Programs\\StartUp",
"C:\\Windows\\Tasks"
]);
// Set an exclusion list for items that are expected (reduce noise by adding known-good startup items here)
let exclusionList = dynamic([
"EXCLUSION_ITEM"
]);
// Search for FileCreated events in startup directories, excluding known items and enrich with Shell Link creation activity
DeviceFileEvents
| where ActionType == "FileCreated"
| where not (FileName has_any (exclusionList))
| where
FolderPath has_any(startupFullPaths)
or FolderPath matches regex @"C:\\Users\\.*?\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
or FolderPath matches regex @"C:\\Documents and Settings\\.*?\\Start Menu\\Programs\\Startup"
| join kind=leftouter (
DeviceEvents
| where ActionType == "ShellLinkCreateFileEvent"
| where
FolderPath has_any(startupFullPaths)
or FolderPath matches regex @"C:\\Users\\.*?\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
or FolderPath matches regex @"C:\\Documents and Settings\\.*?\\Start Menu\\Programs\\Startup"
) on DeviceId