T1547
Boot or Logon Autostart Execution
Linux · macOS · Windows · Network Devices8 pieces on this siteT1547 on attack.mitre.org
Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
How to find what an operator left behind
You have evicted somebody, or believe you have, and need to be sure there is no way back in.
Detect it
Hunts and rules you can run, each stating what it needs and what else it returns.
Q3 detection rule pack: persistence and execution
Sigma, YARA and network rules built from the quarter's CISA advisories, with the advisory cited on every rule and the indicator table they came from attached as CSV.
Find Run-key persistence written recently, and rare across the estate.
The evidence it leaves
Where the traces live, and what each source proves and does not.
Run and RunOnce keys
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
Guided lab: read Windows event logs without Windows
Every other lab here asks for a virtual machine. This one asks for a terminal. Pre-recorded event logs, a cross-platform parser, and the same reasoning, on whatever laptop you already have.
Guided lab: find the Run key before it finds you
A first investigation for anyone who has read about persistence but never gone looking for it. You will plant a Run key with Atomic Red Team, then find it three different ways and work out which of the three you would actually trust in production.
Read
Analyses, case studies, guides, references and interview questions.
Run key persistence: what the registry alone will not tell you
A lab reconstruction of a user-level persistence case, and why the Run key timestamp is the least useful thing in the artifact set.
how MITRE says to see it
Boot or Logon Autostart Execution Detection Strategy
- Correlation of registry key modification for Run/RunOnce with abnormal parent-child process relationships and outlier execution at user logon or system startup
- Correlates creation/modification of systemd service files or /etc/init.d scripts with outlier process behavior during boot
- Observes creation or modification of LaunchAgent/LaunchDaemon property list files combined with anomalous plist payload execution after user logon
sub-techniques
- T1547.001 Registry Run Keys / Startup Folder
- T1547.002 Authentication Package
- T1547.003 Time Providers
- T1547.004 Winlogon Helper DLL
- T1547.005 Security Support Provider
- T1547.006 Kernel Modules and Extensions
- T1547.007 Re-opened Applications
- T1547.008 LSASS Driver
- T1547.009 Shortcut Modification
- T1547.010 Port Monitors
- T1547.012 Print Processors
- T1547.013 XDG Autostart Entries
- T1547.014 Active Setup
- T1547.015 Login Items