Skip to content

Hide Navigation Hide TOC

Modify User Shell Folders Startup Value (9c226817-8dc9-46c2-a58d-66655aafd7dc)

Detect modification of the startup key to a path where a payload could be stored to be launched during startup

Cluster A Galaxy A Cluster B Galaxy B Level
Registry Run Keys / Startup Folder - T1547.001 (9efb1ea7-c37b-4595-9640-b7680cd84279) Attack Pattern Modify User Shell Folders Startup Value (9c226817-8dc9-46c2-a58d-66655aafd7dc) Sigma-Rules 1
Registry Run Keys / Startup Folder - T1547.001 (9efb1ea7-c37b-4595-9640-b7680cd84279) Attack Pattern Boot or Logon Autostart Execution - T1547 (1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf) Attack Pattern 2