reference startup folder

rule:
  meta:
    name: reference startup folder
    namespace: persistence/startup-folder
    authors:
      - matthew.williams@mandiant.com
    scopes:
      static: file
      dynamic: file
    att&ck:
      - Persistence::Boot or Logon Autostart Execution::Registry Run Keys / Startup Folder [T1547.001]
  features:
    - or:
      - string: /Start Menu\\Programs\\Startup/i