File Transfer to Windows Autostart Path

After infiltrating a network, an attacker can laterally move across the network by compromising new target devices. While an attacker can transfer an executable file to a target device over the SMB protocol to a Windows device, a malicious payload will not automatically run. However, an attacker with administrator credentials can copy the file to a startup path, such as C$\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup. The files in this path run automatically during startup processes, such as boot or login, delivering the malicious payload.