File Written to Remote Startup Folder via SMB

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects when a file is written to a remote Windows Startup folder via Server Message Block (SMB). The rule specifically looks for SMB traffic containing the string "Startup" and "\AppData\Roaming\Microsoft\Windows\" (case-insensitive) in the flow to the server. This activity is often associated with persistence mechanisms where malware or an attacker attempts to execute code automatically upon system startup.