Boot or Logon Autostart Execution

T1547

Technique with 14 sub-techniques.View on attack.mitre.org

About this technique

Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon. These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel.

Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.

Detection rules86

Rules on DetectionCode tagged with T1547 or one of its sub-techniques.

Sigma53

Rule	Level	Log source	Technique
Bypass UAC Using Event Viewer	high	windows / registry_set	T1547.010
Creation Exe for Service with Unquoted Path	high	windows / file_event	T1547.009
Default RDP Port Changed to Non Standard Port	high	windows / registry_set	T1547.010
DLL Load via LSASS	high	windows / registry_event	T1547.008
File Creation In Suspicious Directory By Msdt.EXE	high	windows / file_event	T1547.001
Loading of Kernel Module via Insmod	high	linux / NULL	T1547.006
Modify User Shell Folders Startup Value	high	windows / registry_set	T1547.001
Narrator's Feedback-Hub Persistence	high	windows / registry_event	T1547.001
New RUN Key Pointing to Suspicious Folder	high	windows / registry_set	T1547.001
New TimeProviders Registered With Uncommon DLL Name	high	windows / registry_set	T1547.003
Potential RipZip Attack on Startup Folder	high	windows / file_event	T1547
Potential Startup Shortcut Persistence Via PowerShell.EXE	high	windows / file_event	T1547.001
Registry Persistence Mechanisms in Recycle Bin	high	windows / registry_event	T1547
Registry Persistence via Explorer Run Key	high	windows / registry_set	T1547.001
Security Support Provider (SSP) Added to LSA Configuration	high	windows / registry_event	T1547.005
Suspicious Autorun Registry Modified via WMI	high	windows / process_creation	T1547.001
Suspicious GrpConv Execution	high	windows / process_creation	T1547
Suspicious Run Key from Download	high	windows / registry_event	T1547.001
Suspicious Startup Folder Persistence	high	windows / file_event	T1547.001
User Shell Folders Registry Modification via CommandLine	high	windows / process_creation	T1547.001
VBScript Payload Stored in Registry	high	windows / registry_set	T1547.001
Windows Event Log Access Tampering Via Registry	high	windows / registry_set	T1547.001
WINEKEY Registry Modification	high	windows / registry_event	T1547
Winlogon Notify Key Logon Persistence	high	windows / registry_set	T1547.004
WinRAR Creating Files in Startup Locations	high	windows / file_event	T1547.001
Add Port Monitor Persistence in Registry	medium	windows / registry_set	T1547.010
Atbroker Registry Change	medium	windows / registry_event	T1547
Classes Autorun Keys Modification	medium	windows / registry_set	T1547.001
Common Autorun Keys Modification	medium	windows / registry_set	T1547.001
CurrentControlSet Autorun Keys Modification	medium	windows / registry_set	T1547.001
CurrentVersion Autorun Keys Modification	medium	windows / registry_set	T1547.001
CurrentVersion NT Autorun Keys Modification	medium	windows / registry_set	T1547.001
Desktop.INI Created by Uncommon Process	medium	windows / file_event	T1547.009
Direct Autorun Keys Modification	medium	windows / process_creation	T1547.001
Internet Explorer Autorun Keys Modification	medium	windows / registry_set	T1547.001
MITRE BZAR Indicators for Persistence	medium	zeek / NULL	T1547.004
New Custom Shim Database Created	medium	windows / file_event	T1547.009
Office Autorun Keys Modification	medium	windows / registry_set	T1547.001
Potential Persistence Attempt Via Run Keys Using Reg.EXE	medium	windows / process_creation	T1547.001
Potential Suspicious Activity Using SeCEdit	medium	windows / process_creation	T1547.001 T1547.002 T1547.010 T1547.014
Session Manager Autorun Keys Modification	medium	windows / registry_set	T1547.001
Startup Folder File Write	medium	windows / file_event	T1547.001
Startup/Logon Script Added to Group Policy Object	medium	windows / NULL	T1547
Suspicious Driver Install by pnputil.exe	medium	windows / process_creation	T1547
Suspicious PowerShell In Registry Run Keys	medium	windows / registry_set	T1547.001
System Scripts Autorun Keys Modification	medium	windows / registry_set	T1547.001
Windows Network Access Suspicious desktop.ini Action	medium	windows / NULL	T1547.009
Windows Terminal Profile Settings Modification By Uncommon Process	medium	windows / file_event	T1547.015
Winlogon Helper DLL	medium	windows / ps_script	T1547.004
WinSock2 Autorun Keys Modification	medium	windows / registry_set	T1547.001
Wow6432Node Classes Autorun Keys Modification	medium	windows / registry_set	T1547.001
Wow6432Node CurrentVersion Autorun Keys Modification	medium	windows / registry_set	T1547.001
Wow6432Node Windows NT CurrentVersion Autorun Keys Modification	medium	windows / registry_set	T1547.001

Splunk33

Rule	Type	Risk	Data source	Technique
Active Setup Registry Autostart	TTP	NULL	Sysmon EventID 13	T1547.014
Linux Auditd Insert Kernel Module Using Insmod Utility	Anomaly	NULL	Linux Auditd Syscall	T1547.006
Linux Auditd Install Kernel Module Using Modprobe Utility	Anomaly	NULL	Linux Auditd Syscall	T1547.006
Linux Auditd Kernel Module Using Rmmod Utility	TTP	NULL	Linux Auditd Syscall	T1547.006
Linux Auditd Unload Module Via Modprobe	TTP	NULL	Linux Auditd Execve	T1547.006
Linux File Created In Kernel Driver Directory	Anomaly	NULL	Sysmon for Linux EventID 11	T1547.006
Linux File Creation In System Generator Directory	Anomaly	NULL	Sysmon for Linux EventID 11	T1547
Linux Insert Kernel Module Using Insmod Utility	Anomaly	NULL	Sysmon for Linux EventID 1	T1547.006
Linux Install Kernel Module Using Modprobe Utility	Anomaly	NULL	Sysmon for Linux EventID 1	T1547.006
Linux MOTD Script Added	Anomaly	NULL	Sysmon for Linux EventID 11	T1547
Linux Suspicious XDG Autostart	Anomaly	NULL	Sysmon for Linux EventID 11	T1547
Linux UDEV Rule Created	Anomaly	NULL	Sysmon for Linux EventID 11	T1547
Monitor Registry Keys for Print Monitors	TTP	NULL	Sysmon EventID 13	T1547.010
Print Processor Registry Autostart	TTP	NULL	Sysmon EventID 13	T1547.012
Print Spooler Adding A Printer Driver	TTP	NULL	Windows Event Log Printservice 316	T1547.012
Print Spooler Failed to Load a Plug-in	TTP	NULL	Windows Event Log Printservice 808, Windows Event Log Printservice 4909	T1547.012
Registry Keys Used For Persistence	TTP	NULL	Sysmon EventID 13	T1547.001
Spoolsv Spawning Rundll32	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1547.012
Spoolsv Suspicious Loaded Modules	TTP	NULL	Sysmon EventID 7	T1547.012
Spoolsv Writing a DLL	TTP	NULL	Sysmon EventID 1 AND Sysmon EventID 11, Windows Event Log Security 4688 AND Sysmon EventID 11	T1547.012
Spoolsv Writing a DLL - Sysmon	TTP	NULL	Sysmon EventID 11	T1547.012
Time Provider Persistence Registry	TTP	NULL	Sysmon EventID 13	T1547.003
Windows Audit Policy Auditing Option Modified - Registry	Anomaly	NULL	Sysmon EventID 13	T1547.014
Windows Autostart Execution LSASS Driver Registry Modification	TTP	NULL	Sysmon EventID 13	T1547.008
Windows Boot or Logon Autostart Execution In Startup Folder	Anomaly	NULL	Sysmon EventID 11	T1547.001
Windows NorthStar C2 Agent Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1547.001
Windows PowerShell MSIX Package Installation	TTP	NULL	Powershell Script Block Logging 4104	T1547.001
Windows Registry BootExecute Modification	TTP	NULL	Sysmon EventID 13	T1547.001
Windows Registry Modification for Safe Mode Persistence	TTP	NULL	Sysmon EventID 13	T1547.001
Windows Security Support Provider Reg Query	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1547.005
Windows Snake Malware Kernel Driver Comadmin	TTP	NULL	Sysmon EventID 11	T1547.006
Windows Snake Malware Service Create	TTP	NULL	Windows Event Log System 7045	T1547.006
Windows Unsigned MS DLL Side-Loading	Anomaly	NULL	Sysmon EventID 7	T1547

Sub-techniques14

ID	Name	Examples
T1547.001	Registry Run Keys / Startup Folder	261
T1547.002	Authentication Package	1
T1547.003	Time Providers	0
T1547.004	Winlogon Helper DLL	13
T1547.005	Security Support Provider	3
T1547.006	Kernel Modules and Extensions	4
T1547.007	Re-opened Applications	0
T1547.008	LSASS Driver	2
T1547.009	Shortcut Modification	29
T1547.010	Port Monitors	0
T1547.012	Print Processors	3
T1547.013	XDG Autostart Entries	7
T1547.014	Active Setup	1
T1547.015	Login Items	3

Groups1

APT42

Software5

BoxCaon Dtrack Mis-Type Misdat xCaon

Campaigns0

None recorded.

Procedure examples6

Groups1

Used by	Procedure example
GroupAPT42	APT42 has modified the Registry to maintain persistence. Mandiant APT42-charms

Software5

Used by	Procedure example
MalwareBoxCaon	BoxCaon established persistence by setting the `HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load` registry key to point to its executable. Checkpoint IndigoZebra July 2021
MalwareDtrack	Dtrack’s RAT makes a persistent target file with auto execution on the host start. Securelist Dtrack
MalwareMis-Type	Mis-Type has created registry keys for persistence, including `HKCU\Software\bkfouerioyou`, `HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{6afa8072-b2b1-31a8-b5c1-{Unique Identifier}`, and `HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{3BF41072-B2B1-31A8-B5C1-{Unique Identifier}`. Cylance Dust Storm
MalwareMisdat	Misdat has created registry keys for persistence, including `HKCU\Software\dnimtsoleht\StubPath`, `HKCU\Software\snimtsOleht\StubPath`, `HKCU\Software\Backtsaleht\StubPath`, `HKLM\SOFTWARE\Microsoft\Active Setup\Installed. Components\{3bf41072-b2b1-21c8-b5c1-bd56d32fbda7}`, and `HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{3ef41072-a2f1-21c8-c5c1-70c2c3bc7905}`. Cylance Dust Storm
MalwarexCaon	xCaon has added persistence via the Registry key `HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load` which causes the malware to run each time any user logs in. Checkpoint IndigoZebra July 2021

References5

Cylance Reg Persistence Sept 2013 Open source
Langendorf, S. (2013, September 24). Windows Registry Persistence, Part 2: The Run Keys and Search-Order. Retrieved November 17, 2024.
Linux Kernel Programming Open source
Pomerantz, O., Salzman, P.. (2003, April 4). The Linux Kernel Module Programming Guide. Retrieved April 6, 2018.
MSDN Authentication Packages Open source
Microsoft. (n.d.). Authentication Packages. Retrieved March 1, 2017.
Microsoft Run Key Open source
Microsoft. (n.d.). Run and RunOnce Registry Keys. Retrieved September 12, 2024.
Microsoft TimeProvider Open source
Microsoft. (n.d.). Time Provider. Retrieved March 26, 2018.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.