Startup Folder Persistence via Sysmon Event ID 11

Jorden Smith@Jorden

•updated Feb 10, 2026•3•0•31

This rule detects the creation of specific file types (batch scripts, command scripts, VBScripts, JScripts, PowerShell scripts, or shortcut files) within the Windows Startup folder. This activity is often used for persistence, allowing an attacker's code to execute automatically when a user logs in or the system starts.