MITRE ATT&CKtechnique

T1547 Boot or Logon Autostart Execution

Published 2020-01-23 Modified 2025-10-24 Official page ↗

Domain: enterprise
Tactics: Persistence, Privilege Escalation
Platforms: Linux, macOS, Windows, Network Devices
Version: 1.3
Created: 2020-01-23

Description

Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon. These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel. Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.

Tactic · MITRE ATT&CK (2)

TA0003 Persistence tactic
TA0004 Privilege Escalation tactic

Referenced by MITRE ATT&CK · subtechnique of (14)

T1547.015 Login Items sub-technique
T1547.014 Active Setup sub-technique
T1547.012 Print Processors sub-technique
T1547.002 Authentication Package sub-technique
T1547.003 Time Providers sub-technique
T1547.004 Winlogon Helper DLL sub-technique
T1547.005 Security Support Provider sub-technique
T1547.006 Kernel Modules and Extensions sub-technique
T1547.007 Re-opened Applications sub-technique
T1547.008 LSASS Driver sub-technique
T1547.009 Shortcut Modification sub-technique
T1547.010 Port Monitors sub-technique
T1547.001 Registry Run Keys / Startup Folder sub-technique
T1547.013 XDG Autostart Entries sub-technique

Referenced by MITRE ATT&CK · uses (6)

G1044 APT42 group
S0653 xCaon software (malware)
S0651 BoxCaon software (malware)
S0567 Dtrack software (malware)
S0083 Misdat software (malware)
S0084 Mis-Type software (malware)

Referenced by CAPEC · att&ck technique (1)

CAPEC-564 Run Software at Logon attack pattern

Referenced by Compliance · mitigates (1)

CIS-2.3 Address Unauthorized Software CIS Safeguard v8.1

References

https://web.archive.org/web/20160214140250/http://blog.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order Cylance Reg Persistence Sept 2013
https://msdn.microsoft.com/library/windows/desktop/aa374733.aspx MSDN Authentication Packages
https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys Microsoft Run Key
https://msdn.microsoft.com/library/windows/desktop/ms725475.aspx Microsoft TimeProvider
https://www.tldp.org/LDP/lkmpg/2.4/lkmpg.pdf Linux Kernel Programming
https://technet.microsoft.com/en-us/sysinternals/bb963902 TechNet Autoruns