tfMITRE ATT&CK sub-technique

Active Setup T1547.014

sub-technique of T1547 Boot or Logon Autostart Execution

Tactics: Persistence, Privilege Escalation
Platform: Windows
Version: 1.1
Created: 18 December 2020
Last modified: 24 October 2025
Contributor: Bencherchali Nasreddine, @nas_bench, ELIT Security Team (DSSD)

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine. Active Setup is a Windows mechanism that is used to execute programs when a user logs in. The value stored in the Registry key will be executed after a user logs into the computer.[1] These programs will be executed under the context of the user and will have the account's associated permissions level.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rules54th pct

Detection rules54th percentile · 54% of ATT&CK techniques have this many detection rules written or fewer.

Active Setup MITRE reference T1547.014

44th pctamong all ATT&CK techniques for number of tools

1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

PoisonIvyS0012 ↗

Creates a Registry key in the Active Setup pointing to a malicious executable.1 2 3

created 2017-05-31MALWAREcarried by 14 groups

All 1 software entries for this technique

Offense vs defense T1547.014

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 2

first rule: 2021 Q3

Active Setup detection strategy DET0312

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Active Setup Persistence via StubPath Execution

Enterprise

1 platform

AN0871 · Windows

Multi-event correlation of Registry creation under Active Setup with anomalous execution of processes at user logon. Behavioral patterns include creation/modification of HKLM Active Setup keys with non-standard StubPath values, followed by process execution from uncommon paths, unsigned binaries, or unusual parent-child lineage post-user login.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Windows Registry Key CreationDC0056	WinEventLog:Sysmon	EventCode=12
Windows Registry Key ModificationDC0063	WinEventLog:Sysmon	EventCode=13, 14
Logon Session MetadataDC0088	WinEventLog:Security	EventCode=4672

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Correlate registry change and process execution within a specific user logon session (e.g., 5–10 minutes)
ParentProcessName	Expected parent processes for Active Setup launched binaries (e.g., explorer.exe). Deviations may indicate abuse.
StubPathValueEntropy	Degree of randomness/uncommonness in StubPath values. High entropy may indicate obfuscation.
SignedBinaryStatus	Flag if launched binary in StubPath is unsigned or uncommon for baseline
RegistryKeyOwner	Check which user/context added the Active Setup key to detect privilege abuse

Tests3ExecutorsPowerShell 3Need elevation3 of 3Have prerequisites0Have cleanup2Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

HKLM - Add atomic_test key to launch executable as part of user setup

windows

PowerShell

Required

—

Yes

This test will create an "atomic_test" key under 'HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components' to launch calc by configuring an active setup executable and forcing to run active setup using the "runonce.exe /AlternateShellStartup" command. Without the "runonce.exe /AlternateShellStartup" command it would run during the next logon for each user. Note: If you logout before running the cleanup command, you will be required to go through the OOBE (out-of-box experience) setup sequence to log back in. The payload will only run once unless the cleanup command is run in between tests. Active Setup Explained

Input arguments

Name	Type	Default	Description
payload	string	C:\Windows\System32\calc.exe	Payload to run once during login

Attack command

New-Item "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components" -Name "atomic_test" -Force
Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\atomic_test" "(Default)" "ART TEST" -Force
Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\atomic_test" "StubPath" "#{payload}" -Force 
& $env:SYSTEMROOT\system32\runonce.exe /AlternateShellStartup

Cleanup command

Remove-Item "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\atomic_test" -Force -ErrorAction Ignore
Remove-Item "HKCU:\SOFTWARE\Microsoft\Active Setup\Installed Components\atomic_test" -Force -ErrorAction Ignore

GUIDd20018a8-4802-46e9-9e98-3e5b90bbf3aa

HKLM - Add malicious StubPath value to existing Active Setup Entry

windows

PowerShell

Required

—

Yes

This test will add a StubPath entry to the Active Setup native registry key associated with 'Internet Explorer Core Fonts' (UUID {C9E9A340-D1F1-11D0-821E-444553540600}) Said key doesn't have a StubPath value by default, by adding one it will launch calc by forcing to run active setup using runonce.exe /AlternateShellStartup. Without the last command it will normally run on next user logon. Note: this test will only run once successfully if no cleanup command is run in between test.

Input arguments

Name	Type	Default	Description
payload	string	C:\Windows\System32\calc.exe	Payload to run once during login

Attack command

Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}" "StubPath" "#{payload}" -Force
& $env:SYSTEMROOT\system32\runonce.exe /AlternateShellStartup

Cleanup command

Remove-ItemProperty "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}" -Name "StubPath" -Force
Remove-ItemProperty "HKCU:\SOFTWARE\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}" -Name "Version" -Force

GUIDc8edc3ee-490b-45fc-82ae-6c71b1c51b50

HKLM - re-execute 'Internet Explorer Core Fonts' StubPath payload by decreasing version number

windows

PowerShell

Required

—

Tests from Atomic Red Team (MIT licence) · technique definition

Active Setup detections T1547.014

3 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

54th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs