fix startup folder persistence rule

mandiant · Dec 5, 2024 · 26742fe · 26742fe
1 parent 7d5aa63
commit 26742fe
Showing 1 changed file with 2 additions and 5 deletions.
diff --git a/persistence/startup-folder/write-file-to-startup-folder.yml b/persistence/startup-folder/write-file-to-startup-folder.yml
@@ -19,13 +19,10 @@ rule:
         - or:
           - match: copy file
           - match: move file
-          - match: host-interaction/file-system/write
+          - match: write file on Windows
       - call:
         - and:
-          - or:
-            - string: /Microsoft\\Windows\\Start Menu\\Programs\\Startup\\/i
-            - string: /Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\/i
-            - string: /WINNT\\Profiles\\All Users\\Start Menu\\Programs\\Startup\\/i
+          - match: reference startup folder
           - or:
             - match: copy file
             - match: move file