tfMITRE ATT&CK technique

Boot or Logon Autostart Execution T1547

Tactics: Persistence, Privilege Escalation
Platforms: Linux, macOS, Windows, Network Devices
Version: 1.3
Created: 23 January 2020
Last modified: 24 October 2025

Sub-techniques 1497 rules across the family · 12 mapped directly to T1547 · 12 of 14 carry rules

.001Registry Run Keys / Startup Folder46 .002Authentication Package1 .003Time Providers2 .004Winlogon Helper DLL4 .005Security Support Provider2 .006Kernel Modules and Extensions11 .007Re-opened Applications0 .008LSASS Driver2 .009Shortcut Modification4 .010Port Monitors5 .012Print Processors7 .013XDG Autostart Entries0 .014Active Setup3 .015Login Items1

Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon.[1][2][3][4][5] These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware66th pct

Tools & malware66th percentile · 66% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 21%

Detection rules79th percentile · 79% of ATT&CK techniques have this many detection rules written or fewer.

Boot or Logon Autostart Execution MITRE reference T1547

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

APT42G1044 ↗

Has modified the Registry to maintain persistence.1

created 2025-01-081 reference

All 1 groups for this technique

5 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

xCaonS0653 ↗

Has added persistence via the Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load which causes the malware to run each time any user logs in.1

created 2021-09-29MALWAREcarried by 1 group

BoxCaonS0651 ↗

Established persistence by setting the HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load registry key to point to its executable.1

created 2021-09-27MALWAREcarried by 1 group

DtrackS0567 ↗

Dtrack’s RAT makes a persistent target file with auto execution on the host start.1

created 2021-01-25MALWAREcarried by 1 group

Mis-TypeS0084 ↗

Has created registry keys for persistence, including HKCU\Software\bkfouerioyou, HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{6afa8072-b2b1-31a8-b5c1-{Unique Identifier}, and HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{3BF41072-B2B1-31A8-B5C1-{Unique Identifier}.1

created 2017-05-31MALWARE

MisdatS0083 ↗

Has created registry keys for persistence, including HKCU\Software\dnimtsoleht\StubPath, HKCU\Software\snimtsOleht\StubPath, HKCU\Software\Backtsaleht\StubPath, HKLM\SOFTWARE\Microsoft\Active Setup\Installed. Components\{3bf41072-b2b1-21c8-b5c1-bd56d32fbda7}, and HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{3ef41072-a2f1-21c8-c5c1-70c2c3bc7905}.1

created 2017-05-31MALWARE

All 5 software entries for this technique

Offense vs defense T1547

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 7Splunk ESCU (cumulative) · 5

first rule: 2020 Q4

Boot or Logon Autostart Execution detection strategy DET0274

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Boot or Logon Autostart Execution Detection Strategy

Enterprise

3 platforms

AN0764 · Windows

Correlation of registry key modification for Run/RunOnce with abnormal parent-child process relationships and outlier execution at user logon or system startup

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Windows Registry Key ModificationDC0063	WinEventLog:Sysmon	EventCode=13, 14

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ParentProcessName	Customize based on expected parent-child process lineage for autostarts
StartupRegistryPath	May vary based on organization policy or installed software

AN0765 · Linux

Correlates creation/modification of systemd service files or /etc/init.d scripts with outlier process behavior during boot

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	Execution of binaries located in /etc/init.d/ or systemd service paths
File CreationDC0039	auditd:SYSCALL	creat
File ModificationDC0061	auditd:SYSCALL	write

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
FilePath	Organizations may use different init systems or custom startup paths
UserContext	Autostart scripts should run as root or system users; deviations are suspect

AN0766 · macOS

Observes creation or modification of LaunchAgent/LaunchDaemon property list files combined with anomalous plist payload execution after user logon

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Execution of binary listed in newly modified LaunchAgent plist
Service MetadataDC0041	macos:unifiedlog	Observed loading of new LaunchAgent or LaunchDaemon plist
File ModificationDC0061	macos:unifiedlog	write

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PlistKey	Organizations may use specific keys or additional payload parameters
TimeWindow	Tunable based on expected delay between plist write and execution

Tests3Executorscmd 2 · PowerShell 1Need elevation1 of 3Have prerequisites0Have cleanup1Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Add a driver

windows

cmd

—

Install a driver via pnputil.exe lolbin

Input arguments

Name	Type	Default	Description
driver_inf	path	C:\Windows\INF\usbstor.inf	A built-in, already installed windows driver inf

Attack command

pnputil.exe /add-driver "#{driver_inf}"

GUID9b121039-12f6-4ab0-8ea8-2e9968180841

Driver Installation Using pnputil.exe

windows

PowerShell

—

pnputil.exe is a native command-line utility in Windows to install drivers, this can be abused by to install malicious drivers. Ref: https://lolbas-project.github.io/lolbas/Binaries/Pnputil/

Input arguments

Name	Type	Default	Description
driver_path	path	C:\Windows\INF\acpipmi.inf	Enter the driver file path to install (Default is used built-in windows driver - acpipmi.inf)

Attack command

pnputil.exe -i -a #{driver_path}

GUID4a419678-204e-4919-95ed-1156e65289f1

Leverage Virtual Channels to execute custom DLL during successful RDP session

windows

cmd

Required

—

Yes

Virtual Channels can be leveraged to alter RDP behavior using dedicated Addins.The mechanism is implemented using DLLs which can be executed during RDP session automatically. The DLLs are loaded in the host system only after successful connection is established with the remote system. Once the test is run, amsi.dll will be loaded on the host system during successful RDP session. Blog :https://learn.microsoft.com/en-us/windows/win32/termserv/terminal-services-virtual-channels?redirectedfrom=MSDN

Input arguments

Name	Type	Default	Description
dll_inf	Path	C:\Windows\System32\amsi.dll	custom DLL to be executed
Subkey_Added	String	Malware	New Sub key added in the registry path

Attack command

reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default\Addins\#{Subkey_Added}" /v Name /t REG_SZ /d "#{dll_inf}" /f

Cleanup command

reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default\Addins\#{Subkey_Added}" /f

GUID726a3f02-2f82-487f-ae09-4f28aa5b222f

Tests from Atomic Red Team (MIT licence) · technique definition

Boot or Logon Autostart Execution detections T1547

12 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 21%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs