Office Startup Folder File Written via Network Share

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects when a file containing the string "XLSTART" (case-insensitive) is written to a network share via SMB. This is indicative of an attempt to establish persistence by placing malicious files in the Microsoft Office startup folder, which will be executed when Office applications launch.