Adversaries can achieve persistence by adding their malicious binary in the startup folders. When the operating system starts, the startup folder is looked up and files residing in this folder are executed. The Windows operating system maintains two types of startup folders: (a) user wide and (b) system-wide, as shown in the following code. A program residing in the user's startup folder is executed only for a specific user and the program residing in the system folder is executed when any user logs on to the system. Administrator privilege is required to achieve persistence using a system-wide startup folder:

C:\%AppData%MicrosoftWindowsStart MenuProgramsStartup
C:ProgramDataMicrosoftWindowsStart MenuProgramsStartup

In the following example, the malware (Backdoor.Nitol) first drops a file in the %AppData% directory. It then creates a shortcut (.lnk) that points to the dropped file and then adds that shortcut to the Startup folder. This way, when the system starts, the dropped file gets executed via the shortcut (.lnk) file:

[CreateFile] bllb.exe:3364 > %AppData%Abcdef Hijklmno QrsAbcdef Hijklmno Qrs.exe
[CreateFile] bllb.exe:3364 > %AppData%MicrosoftWindowsStart MenuProgramsStartupAbcdef Hijklmno Qrs.exe.lnk

To detect this type of attack, you can monitor the entries added and changes made to the startup folders.