T1547 · Boot or Logon Autostart Execution

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1547 · Boot or Logon Autostart Execution · Sunturai

attack-patternenterprise-attackT1547

Boot or Logon Autostart Execution

attack-pattern--1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf

Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key) (Citation: MSDN Authentication Packages) (Citation: Microsoft TimeProvider) (Citation: Cylance Reg Persistence Sept 2013) (Citation: Linux Kernel Programming) These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel. Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.

Created: Jan 23, 2020, 5:46 PM UTC
Modified: Oct 24, 2025, 5:48 PM UTC

14 sub-techniques under this technique

Each is its own technique in the catalogue, with its own detections.

89 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Network Connections Initiated Through XDG Autostart Entry	Medium	Elastic detection rules	Oct 9, 2026	Elastic License 2.0
Startup/Logon Script added to Group Policy Object	Medium	Elastic detection rules	Oct 8, 2026	Elastic License 2.0
Persistence via a Hidden Plist Filename via macOS Security Events	Medium	Elastic detection rules	Oct 8, 2026	Elastic License 2.0
Startup or Run Key Registry Modification	Low	Elastic detection rules	Oct 6, 2026	Elastic License 2.0
Persistence via a Windows Installer	Medium	Elastic detection rules	Oct 6, 2026	Elastic License 2.0
Kernel Object File Creation	Low	Elastic detection rules	Oct 6, 2026	Elastic License 2.0
KDE AutoStart Script or Desktop File Creation	Medium	Elastic detection rules	Oct 6, 2026	Elastic License 2.0
Potential Port Monitor or Print Processor Registration Abuse	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential LSA Authentication Package Abuse	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
First Time Seen Driver Loaded	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Persistence via WMI Standard Registry Provider	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Installation of Security Support Provider	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Persistence via Hidden Run Key Detected	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Persistence via Time Provider Modification	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Persistence via Mandatory User Profile	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Persistent Scripts in the Startup Directory	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Startup Folder Persistence via Unsigned Process	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Startup Persistence by a Suspicious Process	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Execution of Persistent Suspicious Program	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Uncommon Registry Persistence Change	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Startup Shell Folder Modification	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Lateral Movement via Startup Folder	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential PowerShell HackTool Script by Function Names	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Mimikatz Memssp Log File Detected	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Module Loaded by LSASS	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0

Showing 25 of 89

Filter in the catalogue

External references

mitre-attackT1547Open reference

Cylance Reg Persistence Sept 2013Open reference

MSDN Authentication PackagesOpen reference

Microsoft Run KeyOpen reference

Microsoft TimeProviderOpen reference

Linux Kernel ProgrammingOpen reference

TechNet AutorunsOpen reference

Platforms

LinuxmacOSNetwork DevicesWindows

Kill chain phases

persistenceprivilege-escalation

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object