HTA Startup Persistence

Description

Use this query to locate persistence in Startup with HTA files.

Query · kql

DeviceFileEvents
| where FolderPath contains @"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\"
| where FileName endswith ".hta"
Raw source HTA Startup Persistence · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 10d275ce-bb52-41b7-b67e-05b974ed1179
name: HTA Startup Persistence
description: |
  Use this query to locate persistence in Startup with HTA files.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
tactics:
- Ransomware
query: |
  DeviceFileEvents
  | where FolderPath contains @"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\"
  | where FileName endswith ".hta"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.