T1547.001sub-technique of T1547 Boot or Logon Autostart Execution
Registry Run Keys / Startup Folder
Windows8 pieces on this siteT1547.001 on attack.mitre.org
Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
How to find what an operator left behind
You have evicted somebody, or believe you have, and need to be sure there is no way back in.
Detect it
Hunts and rules you can run, each stating what it needs and what else it returns.
Q3 detection rule pack: persistence and execution
Sigma, YARA and network rules built from the quarter's CISA advisories, with the advisory cited on every rule and the indicator table they came from attached as CSV.
Find Run-key persistence written recently, and rare across the estate.
The evidence it leaves
Where the traces live, and what each source proves and does not.
Run and RunOnce keys
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
Guided lab: read Windows event logs without Windows
Every other lab here asks for a virtual machine. This one asks for a terminal. Pre-recorded event logs, a cross-platform parser, and the same reasoning, on whatever laptop you already have.
Guided lab: find the Run key before it finds you
A first investigation for anyone who has read about persistence but never gone looking for it. You will plant a Run key with Atomic Red Team, then find it three different ways and work out which of the three you would actually trust in production.
Read
Analyses, case studies, guides, references and interview questions.
Run key persistence: what the registry alone will not tell you
A lab reconstruction of a user-level persistence case, and why the Run key timestamp is the least useful thing in the artifact set.
how MITRE says to see it
Detect Registry and Startup Folder Persistence (Windows)
- Correlation of Registry key creation/modification events under known Run/Startup keys with new or unusual binary paths or script-based payloads. Multi-event detection includes registry modification followed by process execution from non-standard directories or abnormal parent-child process relationships.
the rest of T1547
- T1547.002 Authentication Package
- T1547.003 Time Providers
- T1547.004 Winlogon Helper DLL
- T1547.005 Security Support Provider
- T1547.006 Kernel Modules and Extensions
- T1547.007 Re-opened Applications
- T1547.008 LSASS Driver
- T1547.009 Shortcut Modification
- T1547.010 Port Monitors
- T1547.012 Print Processors
- T1547.013 XDG Autostart Entries
- T1547.014 Active Setup
- T1547.015 Login Items