Potential Persistence via ErrorHandler.cmd

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•18

Detects the creation of a file named "ErrorHandler.cmd" in the "C:\WINDOWS\Setup\Scripts\" directory. This file can be used as a persistence mechanism because its content is executed whenever certain tools under "C:\WINDOWS\System32\oobe\" (e.g., Setup.exe) fail to run.