Executable Dropped into the Startup Folder

Detects a file being created directly in the current user's Startup folder - anything placed here runs automatically at next logon, making it one of the simplest and most common persistence mechanisms.

T1547.001

Detection logic

{
  "detection_type": "selection",
  "selection": {
    "EventID": 11,
    "TargetFilename|contains": "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\",
    "TargetFilename|endswith": [
      ".exe",
      ".lnk",
      ".vbs"
    ]
  }
}

Log source: product=windows, service=sysmon · Event ID(s): 11

Required log fields

TargetFilename
Image
User

Enabling this in your environment

Where: Sysmon configuration - FileCreate (Event ID 11), scoped to the Startup folder path to keep volume manageable.

sysmon64.exe -c sysmonconfig.xml

FileCreate is very high volume system-wide - nearly every real-world config scopes this to specific interesting paths (Startup, Temp, Downloads) rather than logging every file write on disk.

False positives

Legitimate software installers that intentionally add a startup shortcut (e.g. a chat app, a sync client)

References

https://attack.mitre.org/techniques/T1547/001/