tfMITRE ATT&CK technique

Boot or Logon Autostart Execution T1547

Tactics: Persistence, Privilege Escalation
Platforms: Linux, macOS, Windows, Network Devices
Version: 1.3
Created: 23 January 2020
Last modified: 24 October 2025

Sub-techniques 1497 rules across the family · 12 mapped directly to T1547 · 12 of 14 carry rules

.001Registry Run Keys / Startup Folder46 .002Authentication Package1 .003Time Providers2 .004Winlogon Helper DLL4 .005Security Support Provider2 .006Kernel Modules and Extensions11 .007Re-opened Applications0 .008LSASS Driver2 .009Shortcut Modification4 .010Port Monitors5 .012Print Processors7 .013XDG Autostart Entries0 .014Active Setup3 .015Login Items1

Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon.[1][2][3][4][5] These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware66th pct

Tools & malware66th percentile · 63% of ATT&CK techniques have fewer tools implementing them.

Detection rulesTop 21%

Detection rules79th percentile · 77% of ATT&CK techniques have fewer detection rules written.

Offense vs defense T1547

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 7Splunk ESCU (cumulative) · 5

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Windows Registry Key ModificationDC0063	WinEventLog:Sysmon	EventCode=13, 14

Data component

Name

Channel

Process CreationDC0032

WinEventLog:Security

EventCode=4688

Windows Registry Key ModificationDC0063

WinEventLog:Sysmon

EventCode=13, 14

Field	What you tune
ParentProcessName	Customize based on expected parent-child process lineage for autostarts
StartupRegistryPath	May vary based on organization policy or installed software

Field

What you tune

ParentProcessName

Customize based on expected parent-child process lineage for autostarts

StartupRegistryPath

May vary based on organization policy or installed software

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	Execution of binaries located in /etc/init.d/ or systemd service paths
File CreationDC0039	auditd:SYSCALL	creat
File ModificationDC0061	auditd:SYSCALL	write

Field	What you tune
FilePath	Organizations may use different init systems or custom startup paths
UserContext	Autostart scripts should run as root or system users; deviations are suspect

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Execution of binary listed in newly modified LaunchAgent plist
Service MetadataDC0041	macos:unifiedlog	Observed loading of new LaunchAgent or LaunchDaemon plist
File ModificationDC0061	macos:unifiedlog	write

Field	What you tune
PlistKey	Organizations may use specific keys or additional payload parameters
TimeWindow	Tunable based on expected delay between plist write and execution

Offense vs defense T1547

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 7Splunk ESCU (cumulative) · 5

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Windows Registry Key ModificationDC0063	WinEventLog:Sysmon	EventCode=13, 14

Data component

Name

Channel

Process CreationDC0032

WinEventLog:Security

EventCode=4688

Windows Registry Key ModificationDC0063

WinEventLog:Sysmon

EventCode=13, 14

Field	What you tune
ParentProcessName	Customize based on expected parent-child process lineage for autostarts
StartupRegistryPath	May vary based on organization policy or installed software

Field

What you tune

ParentProcessName

Customize based on expected parent-child process lineage for autostarts

StartupRegistryPath

May vary based on organization policy or installed software

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	Execution of binaries located in /etc/init.d/ or systemd service paths
File CreationDC0039	auditd:SYSCALL	creat
File ModificationDC0061	auditd:SYSCALL	write

Field	What you tune
FilePath	Organizations may use different init systems or custom startup paths
UserContext	Autostart scripts should run as root or system users; deviations are suspect

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Execution of binary listed in newly modified LaunchAgent plist
Service MetadataDC0041	macos:unifiedlog	Observed loading of new LaunchAgent or LaunchDaemon plist
File ModificationDC0061	macos:unifiedlog	write

Field	What you tune
PlistKey	Organizations may use specific keys or additional payload parameters
TimeWindow	Tunable based on expected delay between plist write and execution

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects creation/modification of Assistive Technology applications and persistence with usage of 'at (...)	Generic	test	registry_event	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Stealth System Binary Proxy Execution	-	medium	Mateusz Wydra, oscd.community	2020-10-13	2023-01-19	9577edbb-851f-4243-8c91-1d5b50c1a39b
Splunk	The following analytic detects potential persistence using a systemd generator on Linux, which involves creating a malicious script or binary that is typically executed during the system's boot process. (...)	Anomaly	stable	file_event	linux	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Persistence, Privilege Escalation Boot or Logon Initialization Scripts Startup Items	-	medium	Raven Tait, Splunk	2026-07-08	2026-07-08	06c23568-e05b-4fff-95cd-8b0303b6d032
Splunk	The following analytic detects the creation of a file within the /etc/update-motd.d directory. (...)	Anomaly	stable	file_event	linux	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Persistence, Privilege Escalation Boot or Logon Initialization Scripts Execution Command and Scripting Interpreter Unix Shell	-	medium	Raven Tait, Splunk	2026-07-08	2026-07-08	6dd14256-559b-4364-99d8-0968407b8074
Splunk	The following analytic detects the creation of a .desktop file within XDG autostart directories, including the system-wide /etc/xdg/autostart and user-local ~/.config/autostart paths. (...)	Anomaly	stable	file_event	linux	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Persistence, Privilege Escalation Boot or Logon Initialization Scripts Execution Command and Scripting Interpreter Unix Shell	-	medium	Raven Tait, Splunk	2026-07-08	2026-07-08	dc057fd6-34db-4c41-b8dd-00463c47bf83
Splunk	The following analytic detects the creation of files within udev rules directories, including /etc/udev/rules.d and /usr/lib/udev/rules.d. (...)	Anomaly	stable	file_event	linux	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Persistence, Privilege Escalation Boot or Logon Initialization Scripts	-	medium	Raven Tait, Splunk	2026-07-08	2026-07-08	94d0e307-beae-4f85-8150-69c169b979c1
	Detects a phishing attack which expands a ZIP file containing a malicious shortcut. (...)	Generic	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution	-	high	Greg (rule)	2022-07-21	2023-01-05	a6976974-ea6f-4e97-818e-ea08625c52cb
	Detects persistence registry keys for Recycle Bin	Generic	test	registry_event	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution	-	high	frack113	2021-11-18	2022-12-06	277efb8f-60be-4f10-b4d3-037802f37167
	Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.	Generic	test	account_management	windows	WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Privilege Escalation, Defense Impairment Domain or Tenant Policy Modification Group Policy Modification	-	medium	Elastic, Josh Nickels, Marius Rothenbücher	2024-09-06	—	123e4e6d-b123-48f8-b261-7214938acaf0
	Detects when a possible suspicious driver is being installed via pnputil.exe lolbin	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution	-	medium	Hai Vaknin @LuxNoBulIshit, Avihay eldad @aloneliassaf, Austin Songer @austinsonger	2021-09-30	2022-10-09	a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1
	Detects the suspicious execution of a utility to convert Windows 3.x .grp files or for persistence p (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution	-	high	Florian Roth (Nextron Systems)	2022-05-19	—	f14e169e-9978-4c69-acb3-1cff8200bc36
Splunk	The following analytic identifies potential DLL side-loading instances involving unsigned DLLs mimicking Microsoft signatures. (...)	Anomaly	stable	image_load	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Execution, Stealth Hijack Execution Flow DLL	-	medium	Teoderick Contreras, Splunk	2024-04-17	2026-05-13	8d9e0e06-ba71-4dc5-be16-c1a46d58728c
	Detects potential malicious modification of run keys by winekey or team9 backdoor	Generic	test	registry_event	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution	-	high	omkar72	2020-10-30	2021-11-27	b98968aa-dbc0-4a9c-ac35-108363cbf8d5

Title

Description

Boot or Logon Autostart Execution T1547

Boot or Logon Autostart Execution T1547

Boot or Logon Autostart Execution MITRE reference T1547

Offense vs defense T1547

Boot or Logon Autostart Execution detection strategy DET0274

Boot or Logon Autostart Execution Detection Strategy

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Boot or Logon Autostart Execution MITRE reference T1547

Offense vs defense T1547

Boot or Logon Autostart Execution detection strategy DET0274

Boot or Logon Autostart Execution Detection Strategy

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Boot or Logon Autostart Execution detections T1547

Boot or Logon Autostart Execution detections T1547