persistence_suspicious_startup_shell_folder_modification.yml

name: Suspicious Startup shell folder modification
id: 7a4082f6-f7e3-49bd-9514-dbc8dd4e68ad
version: 1.0.0
description: |
  Detects when adversaries attempt to modify the default Startup
  folder path to to circumvent runtime rules that hunt for file
  creations in the default Startup folder.
labels:
  tactic.id: TA0006
  tactic.name: Persistence
  tactic.ref: https://attack.mitre.org/tactics/TA0006/
  technique.id: T1547
  technique.name: Boot or Logon Autostart Execution
  technique.ref: https://attack.mitre.org/techniques/T1547/
  subtechnique.id: T1547.001
  subtechnique.name: Registry Run Keys / Startup Folder
  subtechnique.ref: https://attack.mitre.org/techniques/T1547/001/

condition: >
  modify_registry
    and
  registry.key.name imatches startup_shell_folder_registry_keys
    and
    not
  (
    registry.value imatches startup_locations
      or
    registry.value imatches ('%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup')
  )

min-engine-version: 2.0.0