MITRE ATT&CKsub-technique

T1547.001 Registry Run Keys / Startup Folder

Published 2020-01-23 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Persistence, Privilege Escalation
Platforms
Windows
Version
2.1
Created
2020-01-23

Description

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level. The following run keys are created by default on Windows systems: • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce Run keys may exist under multiple hives. The HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency. For example, it is possible to load a DLL at logon using a "Depend" key with RunOnceEx: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "C:\temp\evil[.]dll" Placing a program within a startup folder will also cause that program to execute when a user logs in. There is a startup folder location for individual user accounts as well as a system-wide startup folder that will be checked regardless of which user account logs in. The startup folder path for the current user is C:\Users\\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup. The startup folder path for all users is C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp. The following Registry keys can be used to set startup folder items for persistence: • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders The following Registry keys can control automatic startup of services during boot: • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices Using policy settings to specify startup programs creates corresponding values in either of two Registry keys: • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Programs listed in the load value of the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows run automatically for the currently logged-on user. By default, the multistring BootExecute value of the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager is set to autocheck autochk *. This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally. Adversaries can add other programs or processes to this registry value which will automatically launch at boot. Adversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use Masquerading to make the Registry entries look as if they are associated with legitimate programs.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1547 Boot or Logon Autostart Execution technique

Tactic · MITRE ATT&CK (2)

  • TA0003 Persistence tactic
  • TA0004 Privilege Escalation tactic

Referenced by MITRE ATT&CK · uses (267)

  • G1059 NIMBUS MANTICORE group
  • S9059 MiniBike software (malware)
  • S9060 MiniBus software (malware)
  • S9053 MiniJunk software (malware)
  • S9051 The Gentlemen Ransomware software (malware)
  • G1056 TeamPCP group
  • S9037 RustyWater software (malware)
  • G1055 VOID MANTICORE group
  • S9032 MuddyViper software (malware)
  • S9034 Tsundere Botnet software (malware)
  • S9020 LODEINFO software (malware)
  • S9018 HeartCrypt software (malware)
  • S9019 PureCrypter software (malware)
  • S9010 GlassWorm software (malware)
  • G1052 Contagious Interview group
  • S1247 Embargo software (malware)
  • S1245 InvisibleFerret software (malware)
  • S1242 Qilin software (malware)
  • S1239 TONESHELL software (malware)
  • S1236 CLAIMLOADER software (malware)
  • S1230 HIUPAN software (malware)
  • S1228 PUBLOAD software (malware)
  • S1213 Lumma Stealer software (malware)
  • S1212 RansomHub software (malware)
  • G1046 Storm-1811 group
  • S1207 XLoader software (malware)
  • S1199 LockBit 2.0 software (malware)
  • C0047 RedDelta Modified PlugX Infection Chain Operations campaign
  • S1182 MagicRAT software (malware)
  • G1043 BlackByte group
Show all 267 ›

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-270 Modification of Registry Run Keys attack pattern

References