ATT&CK coverage › Technique
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1547.001
Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Events covered
7 catalog events are tagged with this technique by at least one rule.
Authoring guide
Patterns shared across the 37 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.
Fields filtered most (12 distinct)
The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.
Top indicator values (563 distinct)
Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.
Rules under this technique
Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.
Sigma 31 rules
- Classes Autorun Keys Modification
- Common Autorun Keys Modification
- CurrentControlSet Autorun Keys Modification
- CurrentVersion Autorun Keys Modification
- CurrentVersion NT Autorun Keys Modification
- Direct Autorun Keys Modification
- File Creation In Suspicious Directory By Msdt.EXE
- Internet Explorer Autorun Keys Modification
- Modify User Shell Folders Startup Value
- Narrator's Feedback-Hub Persistence
- New RUN Key Pointing to Suspicious Folder
- Office Autorun Keys Modification
- Potential Persistence Attempt Via Run Keys Using Reg.EXE
- Potential Startup Shortcut Persistence Via PowerShell.EXE
- Potential Suspicious Activity Using SeCEdit
- Registry Persistence via Explorer Run Key
- Session Manager Autorun Keys Modification
- Startup Folder File Write
- Suspicious Autorun Registry Modified via WMI
- Suspicious PowerShell In Registry Run Keys
- Suspicious Run Key from Download
- Suspicious Startup Folder Persistence
- System Scripts Autorun Keys Modification
- User Shell Folders Registry Modification via CommandLine
- VBScript Payload Stored in Registry
- Windows Event Log Access Tampering Via Registry
- WinRAR Creating Files in Startup Locations
- WinSock2 Autorun Keys Modification
- Wow6432Node Classes Autorun Keys Modification
- Wow6432Node CurrentVersion Autorun Keys Modification
- Wow6432Node Windows NT CurrentVersion Autorun Keys Modification
Splunk 5 rules
- Registry Keys Used For Persistence
- Windows Boot or Logon Autostart Execution In Startup Folder
- Windows PowerShell MSIX Package Installation
- Windows Registry BootExecute Modification
- Windows Registry Modification for Safe Mode Persistence