Executable Dropped in Startup Folder via SMB

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects when an executable file (.exe) is dropped into a Windows 'Start Menu\Programs\Startup' folder via Server Message Block (SMB). This is a common technique used by attackers to establish persistence on a compromised system, ensuring that their malicious code runs every time the user logs in or the system starts.