Potential Persistence Via Microsoft Office Startup Folder (0e20c89d-2264-44ae-8238-aeeaba609ece)
Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Office Application Startup - T1137 (2c4d4e92-0ccf-4a97-b54c-86d662988a53) | Attack Pattern | Potential Persistence Via Microsoft Office Startup Folder (0e20c89d-2264-44ae-8238-aeeaba609ece) | Sigma-Rules | 1 |