[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1547":3},{"item":4,"lessons":18,"controls":48,"related":76},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1547","T1547","Boot or Logon Autostart Execution",7,"MITRE","**What attackers do.** Attackers set up programs to start automatically when a system boots or a user logs on, using locations such as registry run keys, startup folders, login items or authentication packages. This serves Persistence and Privilege Escalation.\n\n**How to defend.** Monitor the common autostart locations with endpoint tools and baseline what normally runs at startup. Use application control so new autostart entries cannot launch untrusted code, and limit admin rights that many autostart methods require.\n\n**Signs to look for.** Look for new run key entries pointing to user folders, shortcuts added to startup folders, unusual login items on macOS and changes to authentication or security packages. A common gap is checking only the most common registry keys while attackers use less known ones.","Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon. These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel.\n\nSince some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1547\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44],{"slug":21,"title":22,"published_at":23},"critical-rce-dns-wallet-theft-container-escape-self-healing-malware-highlight-diverse-threat-week","Critical RCE, DNS Wallet Theft, Container Escape & Self-Healing Malware Highlight Diverse Threat Week","2026-10-15T20:20:52.553+00:00",{"slug":25,"title":26,"published_at":27},"avisloader-uses-p2p-c2-and-social-engineering-to-evade-takedowns","AvisLoader Uses P2P C2 and Social Engineering to Evade Takedowns","2026-10-12T16:20:38.324+00:00",{"slug":29,"title":30,"published_at":31},"russian-apt-star-blizzard-deploys-redflick-malware-via-spear-phishing","Russian APT Star Blizzard Deploys RedFlick Malware via Spear-Phishing","2026-09-30T12:21:47.221+00:00",{"slug":33,"title":34,"published_at":35},"ai-powered-malware-autonomously-executes-post-compromise-attack-chains","AI-Powered Malware Autonomously Executes Post-Compromise Attack Chains","2026-09-22T20:21:14.78+00:00",{"slug":37,"title":38,"published_at":39},"fake-it-support-calls-on-teams-lead-to-ransomware-in-under-17-hours","Fake IT Support Calls on Teams Lead to Ransomware in Under 17 Hours","2026-07-30T16:20:25.096+00:00",{"slug":41,"title":42,"published_at":43},"windows-legacyhive-zero-day-enables-privilege-escalation-on-fully-patched-systems","Windows LegacyHive Zero-Day Enables Privilege Escalation on Fully Patched Systems","2026-07-17T12:21:11.31+00:00",{"slug":45,"title":46,"published_at":47},"russian-ctrl-toolkit-exploits-user-trust-and-network-architecture","Russian CTRL Toolkit Exploits User Trust and Network Architecture","2026-03-30T13:07:24.554+00:00",[49,54,59,64,68,72],{"slug":50,"name":51,"problem":52,"stories":53},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",6,{"slug":55,"name":56,"problem":57,"stories":58},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",3,{"slug":60,"name":61,"problem":62,"stories":63},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",2,{"slug":65,"name":66,"problem":67,"stories":63},"patch-management","Automated patch management","Known holes get closed in days, not months.",{"slug":69,"name":70,"problem":71,"stories":63},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":73,"name":74,"problem":75,"stories":63},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[77,82,87,91,95,99,103,107],{"family":78,"item":79,"code":80,"title":81,"together":58},"nist-800-53","si-3","SI-3","Malicious Code Protection",{"family":83,"item":84,"code":85,"title":86,"together":58},"cis","14","Control 14","Security Awareness and Skills Training",{"family":78,"item":88,"code":89,"title":90,"together":58},"at-2","AT-2","Literacy Training and Awareness",{"family":83,"item":92,"code":93,"title":94,"together":58},"17","Control 17","Incident Response Management",{"family":78,"item":96,"code":97,"title":98,"together":58},"si-4","SI-4","System Monitoring",{"family":83,"item":100,"code":101,"title":102,"together":58},"9","Control 9","Email and Web Browser Protections",{"family":83,"item":104,"code":105,"title":106,"together":63},"7","Control 7","Continuous Vulnerability Management",{"family":5,"item":108,"code":109,"title":110,"together":63},"t1566","T1566","Phishing"]