skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunting-for-startup-folder-persistence

Detect T1547.001 startup folder persistence by scanning Windows startup directories and monitoring file creation.

954|172|Updated Mar 13, 2026
Search Tags:#persistence#threat hunting#windows#watchdog#autoruns#t1547.001#startup folder
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-startup-folder-persistence
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunting-for-startup-folder-persistence
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/hunting-for-startup-folder-persistence
Command: npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-startup-folder-persistence

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires watchdog, pefile.

What problem does it solve?

Attackers achieve persistence by dropping executables or shortcuts into Windows startup folders, and security teams often lack a structured procedure to detect these implants across both per-user and all-users directories.

Core Features & Use Cases

  • Startup Directory Scanning: Enumerates files in per-user and all-users startup folders, flagging suspicious extensions like .lnk, .bat, .vbs, .ps1, and .exe.
  • Real-Time Monitoring: Uses Python watchdog FileSystemEventHandler to alert on new file creation in startup directories.
  • Metadata Analysis: Checks creation timestamps, digital signatures, and LNK targets to identify implants less than 7 days old.
  • Use Case: A SOC analyst investigating a compromised host runs this hunt to enumerate startup folder contents, resolve LNK targets pointing to encoded PowerShell, and produce a JSON report mapped to MITRE ATT&CK T1547.001.

Quick Start

Scan the Windows startup folders on this host for suspicious persistence files and generate a T1547.001 threat hunting report.

Frequently Asked Questions about hunting-for-startup-folder-persistence

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect startup folder persistence on Windows?▼

Enumerate files in both the per-user %APPDATA% and all-users %ProgramData% startup folders, flag suspicious extensions like .lnk, .bat, .vbs, .ps1, and .exe, and check creation timestamps under 7 days. Resolve LNK targets to catch shortcuts pointing to encoded PowerShell or UNC paths.

How to monitor Windows startup folders in real time with Python?▼

Use the Python watchdog library's FileSystemEventHandler to watch both startup directories and alert on new file creation events. Monitoring only one folder leaves a blind spot, so attach handlers to both per-user and all-users paths.

Does startup folder monitoring detect persistence in offline user profiles?▼

Live agents only see the logged-on user's AppData, so persistence planted in offline profiles is missed. You must separately scan the startup folders of logged-off user profiles to close this gap.

Why is Windows Event ID 4663 not logging startup folder access?▼

Event ID 4663 only fires when object-access auditing (SACL) is explicitly configured on the startup folders, which is off by default. Enable SACL auditing on both startup directories before relying on this event for correlation.

How do I reduce false positives when hunting startup folder persistence?▼

Baseline legitimate vendor shortcuts such as Teams, Steam, and OEM utilities by signer and resolved target path. Extension filtering alone is insufficient, so always resolve and inspect LNK targets before flagging.

Related Skills

Explore More Software Engineering Skills→
rjonhaasrjonhaas
1

Windows Artifacts (EZ Tools / Autoruns / Event Logs)

Parse Windows forensic artifacts into CSV outputs for DFIR triage.

Community
Advanced
radenadriradenadri

incident-response

Automates structured incident response workflows for production incidents.

Community
Advanced
Pans0020Pans0020

windows-startup-tuning

Audit Windows startup sources and diagnose slow logon causes.

Community
Advanced
balsm-healthbalsm-health
2

hunting-for-unusual-network-connections

Analyze EDR, SIEM, and Sysmon logs for unusual network connections.

Official
Advanced