T1547.009 Shortcut Modification
Subtécnica de T1547 Boot or Logon Autostart Execution
Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process. Adversaries may abuse shortcuts in the startup folder to execute their tools and achieve persistence.(Citation:…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- Creation Exe for Service with Unquoted Pathhightest · windows
- Desktop.INI Created by Uncommon Processmediumtest · windows
- New Custom Shim Database Createdmediumtest · windows
- Windows Network Access Suspicious desktop.ini Actionmediumtest · windows
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.