Startup Folder Redirection
Where the Startup folder points, which an attacker can redirect to their own folder.
Use it to find a Startup folder moved to another path, so you check the folder Windows really runs at logon.
- NTUSER.DAT
- Persistence
What It Is
The User Shell Folders key stores the file-system paths of a user's shell folders, including the Startup folder whose programs Windows runs each time that user signs in. Windows reads these values to find where each special folder lives, since the location can differ between systems. It sits in the user's hive under Explorer\User Shell Folders, and its entries take precedence over the plain Shell Folders key. The same Startup folder is named by CSIDL_STARTUP and by FOLDERID_Startup.
What It Proves
The Startup value in User Shell Folders sets which folder Windows treats as Startup. Changing it makes Windows run whatever sits in the new folder at logon.
What It Does Not Prove
The default is a path inside the user profile, so a changed value is the signal. It governs the location, not the items, so pair it with the folder contents.
Where It Lives
Startup Folder Redirection lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
NTUSER.DAT\C:\What It Looks Like
These are two values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| alice's Startup value is the default path in her profile, so her Startup folder has not been redirected. List the shortcuts in it, as they decide what runs. |
| The all users Startup path in the machine hive is the default too. Its contents, not the path, decide what runs for everyone, so list them as well. |
How to Read It
Read the Startup and Common Startup values in User Shell Folders and Shell Folders. The default Startup is under AppData Roaming Microsoft Windows Start Menu Programs Startup. A value pointing elsewhere, such as ProgramData or a user folder, is the redirection.
- When Windows Writes It
- When the Startup value is changed.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Autoruns, Registry Explorer, RECmd
Hunt It
Microsoft does not say which keys Defender records, so confirm it records this one first. A hit shows the folder moving, not anything in it running.
// Changes to the Startup folder locationDeviceRegistryEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Startup Folder Redirection shows.
- StartupApprovedShows whether each item in the folder is enabled or disabled.
- Startup Folder LNK FilesNot in the RegistryLists the items Windows runs from the folder, with times that date when each was added.
Sources
The facts on this page come from these public pages, which say more on each point.