THREATNOIR
Subscribe
MITRE ATT&CK · T1547

Boot or Logon Autostart Execution

MITRE · cited in 7 of our lessons

Explanation

What attackers do. Attackers set up programs to start automatically when a system boots or a user logs on, using locations such as registry run keys, startup folders, login items or authentication packages. This serves Persistence and Privilege Escalation.

How to defend. Monitor the common autostart locations with endpoint tools and baseline what normally runs at startup. Use application control so new autostart entries cannot launch untrusted code, and limit admin rights that many autostart methods require.

Signs to look for. Look for new run key entries pointing to user folders, shortcuts added to startup folders, unusual login items on macOS and changes to authentication or security packages. A common gap is checking only the most common registry keys while attackers use less known ones.

Open the technique on MITRE ATT&CK
The official text
Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon. These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel. Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.