Cross-source coverage

T1547.001 / ATT&CK

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

103 rules across 6 sources.

Showing deprecated rules · back to the default

From MITRE ATT&CK 19.2

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.

The following run keys are created by default on Windows systems:

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

Run keys may exist under multiple hives. The HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency. For example, it is possible to load a DLL at logon using a "Depend" key with RunOnceEx: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "C:\temp\evil[.]dll"

Placing a program within a startup folder will also cause that program to execute when a user logs in. There is a startup folder location for individual user accounts as well as a system-wide startup folder that will be checked regardless of which user account logs in. The startup folder path for the current user is C:\Users\\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup. The startup folder path for all users is C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp.

The following Registry keys can be used to set startup folder items for persistence:

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

The following Registry keys can control automatic startup of services during boot:

  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices

Using policy settings to specify startup programs creates corresponding values in either of two Registry keys:

  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Programs listed in the load value of the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows run automatically for the currently logged-on user.

By default, the multistring BootExecute value of the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager is set to autocheck autochk *. This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally. Adversaries can add other programs or processes to this registry value which will automatically launch at boot.

Adversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use Masquerading to make the Registry entries look as if they are associated with legitimate programs.

Platforms
Windows
Telemetry
WinEventLog:SysmonWinEventLog:Microsoft-Windows-Shell-Core

How MITRE says to detect it DET0365

Detect Registry and Startup Folder Persistence (Windows)

Windows Analytic 1032

Correlation of Registry key creation/modification events under known Run/Startup keys with new or unusual binary paths or script-based payloads. Multi-event detection includes registry modification followed by process execution from non-standard directories or abnormal parent-child process relationships.

  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Sysmon EventCode=13, 14
  • WinEventLog:Microsoft-Windows-Shell-Core New startup folder shortcut or binary placed in Startup directory

View on attack.mitre.org ↗

SigmaHQ/sigma

39 rules
Detection Severity Format
Leviathan Registry Key Activity Critical Sigma
File Creation In Suspicious Directory By Msdt.EXE High Sigma
Forest Blizzard APT - Custom Protocol Handler Creation High Sigma
Forest Blizzard APT - Custom Protocol Handler DLL Registry Set High Sigma
Kapeka Backdoor Autorun Persistence High Sigma
Modify User Shell Folders Startup Value High Sigma
Narrator's Feedback-Hub Persistence High Sigma
New RUN Key Pointing to Suspicious Folder High Sigma
Potential KamiKakaBot Activity - Winlogon Shell Persistence High Sigma
Potential Ryuk Ransomware Activity High Sigma

+ 29 more from SigmaHQ/sigma → showing the 10 highest-severity

elastic/protections-artifacts

26 rules
Detection Severity Format
Dual Persistence via Startup and Scheduled Task Undefined Elastic TOML
Microsoft Office Process Setting Persistence via Startup Undefined Elastic TOML
Network Connection via Startup Item Undefined Elastic TOML
Persistence via a Process from a Removable or Mounted ISO Device Undefined Elastic TOML
Persistence via GenAI Tool Undefined Elastic TOML
Potential PlugX Registry Modification Undefined Elastic TOML
Registry Modification via Microsoft Office Undefined Elastic TOML
Registry or File Modification from Suspicious Memory Undefined Elastic TOML
Registry Persistence via Microsoft Office Descendant Process Undefined Elastic TOML
Registry Run Key Modified by Unusual Process Undefined Elastic TOML

+ 16 more from elastic/protections-artifacts → showing the 10 highest-severity

elastic/detection-rules

13 rules
Detection Severity Format
Lateral Movement via Startup Folder High Elastic TOML
Persistence via Hidden Run Key Detected High Elastic TOML
Persistence via WMI Standard Registry Provider High Elastic TOML
Potential REMCOS Trojan Execution High Elastic TOML
Suspicious Startup Shell Folder Modification High Elastic TOML
Execution of Persistent Suspicious Program Medium Elastic TOML
Persistence via a Windows Installer Medium Elastic TOML
Persistent Scripts in the Startup Directory Medium Elastic TOML
Potential Persistence via Mandatory User Profile Medium Elastic TOML
Startup Folder Persistence via Unsigned Process Medium Elastic TOML

+ 3 more from elastic/detection-rules → showing the 10 highest-severity

chronicle/detection-rules

11 rules
Detection Severity Format
modify_user_shell_folders_startup_value High YARA-L
new_run_key_pointing_to_suspicious_folder High YARA-L
currentcontrolset_autorun_keys_modification Medium YARA-L
currentversion_autorun_keys_modification Medium YARA-L
direct_autorun_keys_modification Medium YARA-L
potential_suspicious_activity_using_secedit Medium YARA-L
session_manager_autorun_keys_modification Medium YARA-L
suspicious_powershell_in_registry_run_keys Medium YARA-L
malicious_behaviour_on_user_login_microsoft_windows__c0d0s0_group_behavior Undefined YARA-L
malicious_behaviour_on_user_login_microsoft_windows__c0d0s0_group_behavior_part_1 Undefined YARA-L

+ 1 more from chronicle/detection-rules → showing the 10 highest-severity

Wazuh Core Ruleset

8 rules
Detection Severity Format
Powershell process has copied an executable file to Windows start-up folder Critical Wazuh XML
Possible addition of new item to Windows startup registry High Wazuh XML
Registry entry to be executed on next logon points to a remote access tool High Wazuh XML
Suspicious file extension detected in registry ASEP to be executed on next logon High Wazuh XML
An executable file has been copied to Windows start-up folder Medium Wazuh XML
Registry entry to be executed on next logon was modified using command line application reg.exe Medium Wazuh XML
osquery: : CCleaner Trojan Floxif detected on registry path · osquery.name = CCleaner_Trojan.Floxif Low Wazuh XML
osquery: : Sticky registry key backdoor detected for key · osquery.name = StickyKeys_Registry_Backdoor Low Wazuh XML

splunk/security_content

6 rules
Detection Severity Format
Registry Keys Used For Persistence Undefined SPL
Windows Boot or Logon Autostart Execution In Startup Folder Undefined SPL
Windows NorthStar C2 Agent Execution Undefined SPL
Windows PowerShell MSIX Package Installation Undefined SPL
Windows Registry BootExecute Modification Undefined SPL
Windows Registry Modification for Safe Mode Persistence Undefined SPL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.