All Detections

Potential Persistence Attempt Via ErrorHandler.Cmd

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 202504

Detects creation of a file named "ErrorHandler.cmd" in the "C:\WINDOWS\Setup\Scripts\" directory which could be used as a method of persistence The content of C:\WINDOWS\Setup\Scripts\ErrorHandler.cmd is read whenever some tools under C:\WINDOWS\System32\oobe\ (e.g. Setup.exe) fail to run for any reason.

Sigma