Word Startup Folder Payload Drop via SMB

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects attempts to drop a payload into the Microsoft Word startup folder via SMB. The detection is based on the presence of the string "Word\STARTUP" (case-insensitive) in SMB traffic flowing to the server on port 445. This activity is indicative of persistence mechanisms used by attackers to ensure malicious code executes when Word starts.