T1547.001 Registry Run Keys / Startup Folder

persistence · privilege escalation — Windows · attack.mitre.org · JSON

MITRE detection strategy

analytics

Sigma rules tagged attack.t1547.001

KEV CVEs mapped here

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.The following run keys are created by default on Windows systems:

<li><code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run</code></li><li><code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce</code></li><li><code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run</code></li><li><code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce</code></li>Run keys may exist under multiple hives. The <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx</code> is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency. For example, it is possible to load a DLL at logon using a "Depend" key with RunOnceEx: <code>reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "C:\temp\evil[.]dll"</code>Placing a program within a startup folder will also cause that program to execute when a user logs in. There is a startup folder location for individual user accounts as well as a system-wide startup folder that will be checked regardless of which user account logs in. The startup folder path for the current user is <code>C:\Users\\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup</code>. The startup folder path for all users is <code>C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp</code>.The following Registry keys can be used to set startup folder items for persistence:

<li><code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders</code></li><li><code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</code></li><li><code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</code></li><li><code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders</code></li>The following Registry keys can control automatic startup of services during boot:

<li><code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce</code></li><li><code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce</code></li><li><code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices</code></li><li><code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices</code></li>Using policy settings to specify startup programs creates corresponding values in either of two Registry keys:

<li><code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run</code></li><li><code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run</code></li>Programs listed in the load value of the registry key <code>HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows</code> run automatically for the currently logged-on user.By default, the multistring <code>BootExecute</code> value of the registry key <code>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager</code> is set to <code>autocheck autochk *</code>. This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally. Adversaries can add other programs or processes to this registry value which will automatically launch at boot.Adversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use Masquerading to make the Registry entries look as if they are associated with legitimate programs.

KEV CVEs mapped to this technique · CTID Mappings Explorer

CVE	Vendor / product	Mapping type	State	Added
CVE-2022-22047	Microsoft Windows	secondary impact	Mapped	2022-07-12

Detection strategy · ATT&CK Enterprise v19.2

DET0365 Detect Registry and Startup Folder Persistence (Windows) v1.0
AN1032 Windows
Correlation of Registry key creation/modification events under known Run/Startup keys with new or unusual binary paths or script-based payloads. Multi-event detection includes registry modification followed by process execution from non-standard directories or abnormal parent-child process relationships.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=13, 14 → DC0063 Windows Registry Key Modification
WinEventLog:Microsoft-Windows-Shell-Core New startup folder shortcut or binary placed in Startup directory → DC0039 File Creation

Tunable: ImagePath RegistryKeyPath TimeWindow UserContext

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1547.001`

New RUN Key Pointing to Suspicious Folder highexperimental

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing, Swachchhanda Shrawan Poudel (Nextron Systems) · 2018-08-25 (modified 2025-10-06) · logsource: product=windows category=registry_set · 02ee49e2-e294-4d0f-9278-f5b3212fc588

Detects suspicious new RUN key element pointing to an executable in a suspicious folder

Techniques: T1547.001

Session Manager Autorun Keys Modification mediumtest

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) · 2019-10-25 (modified 2023-08-17) · logsource: product=windows category=registry_set · 046218bd-e0d8-4113-a3c3-895a12b2b298

Detects modification of autostart extensibility point (ASEP) in registry.

Techniques: T1547.001 T1546.009

Wow6432Node Classes Autorun Keys Modification mediumtest

Detects modification of autostart extensibility point (ASEP) in registry.

Techniques: T1547.001

Registry Set With Crypto-Classes From The "Cryptography" PowerShell Namespace mediumtest

Author: Andreas Braathen (mnemonic.io) · 2023-12-01 · logsource: product=windows category=registry_set · 1c2a3268-3881-414a-80af-a5b313b14c0e

Detects the setting of a registry inside the "\Shell\Open\Command" value with PowerShell classes from the "System.Security.Cryptography" namespace. The PowerShell namespace "System.Security.Cryptography" provides classes for on-the-fly encryption and decryption. These can be used for example in decrypting malicious payload for defense evasion.

Techniques: T1059.001 T1027.010 T1547.001

Suspicious VBScript UN2452 Pattern hightest

Author: Florian Roth (Nextron Systems) · 2021-03-05 (modified 2022-10-09) · logsource: product=windows category=process_creation · 20c3f09d-c53d-4e85-8b74-6aa50e2f1b61

Detects suspicious inline VBScript keywords as used by UNC2452

Techniques: T1547.001

CurrentVersion Autorun Keys Modification mediumtest

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) · 2019-10-25 (modified 2025-10-22) · logsource: product=windows category=registry_set · 20f0ee37-5942-4e45-b7d5-c5b5db9df5cd

Detects modification of autostart extensibility point (ASEP) in registry.

Techniques: T1547.001

Direct Autorun Keys Modification mediumtest

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems) · 2019-10-25 (modified 2026-01-05) · logsource: product=windows category=process_creation · 24357373-078f-44ed-9ac4-6d334a668a11

Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe.

Techniques: T1547.001

Suspicious Startup Folder Persistence hightest

Author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) · 2022-08-10 (modified 2025-10-12) · logsource: product=windows category=file_event · 28208707-fe31-437f-9a7f-4b1108b94d2e

Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common persistence technique used by threat actors. These files (.ps1, .vbs, .js, .bat, etc.) are automatically executed when a user logs in, making the Startup folder an attractive target for attackers. This technique is frequently observed in malvertising campaigns and malware distribution where attackers attempt to maintain long-term access to compromised systems.

Techniques: T1204.002 T1547.001

Startup Folder File Write mediumtest

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) · 2020-05-02 (modified 2025-12-03) · logsource: product=windows category=file_event · 2aa0a6b4-a865-495b-ab51-c28249537b75

A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.

Techniques: T1547.001

File Creation In Suspicious Directory By Msdt.EXE hightest

Author: Vadim Varganov, Florian Roth (Nextron Systems) · 2022-08-24 (modified 2023-02-23) · logsource: product=windows category=file_event · 318557a5-150c-4c8d-b70e-a9910e199857

Detects msdt.exe creating files in suspicious directories which could be a sign of exploitation of either Follina or Dogwalk vulnerabilities

Techniques: T1547.001

CVE tags: CVE-2022-30190

VBScript Payload Stored in Registry hightest

Author: Florian Roth (Nextron Systems) · 2021-03-05 (modified 2023-08-17) · logsource: product=windows category=registry_set · 46490193-1b22-4c29-bdd6-5bf63907216f

Detects VBScript content stored into registry keys as seen being used by UNC2452 group

Techniques: T1547.001

Wow6432Node Windows NT CurrentVersion Autorun Keys Modification mediumtest

Detects modification of autostart extensibility point (ASEP) in registry.

Techniques: T1547.001

Forest Blizzard APT - Custom Protocol Handler Creation hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2024-04-23 · logsource: product=windows category=registry_set · 5cdeb555-65de-4767-99fe-e26807465148

Detects the setting of a custom protocol handler with the name "rogue". Seen being created by Forest Blizzard APT as reported by MSFT.

Techniques: T1547.001

Leviathan Registry Key Activity criticaltest

Author: Aidan Bracher · 2020-07-07 (modified 2023-09-19) · logsource: product=windows category=registry_event · 70d43542-cd2d-483c-8f30-f16b436fd7db

Detects registry key used by Leviathan APT in Malaysian focused campaign

Techniques: T1547.001

WinRAR Creating Files in Startup Locations highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-07-16 · logsource: product=windows category=file_event · 74a2b37d-fea4-41e0-9ac7-c9fbcf1f60cc

Detects WinRAR creating files in Windows startup locations, which may indicate an attempt to establish persistence by adding malicious files to the Startup folder. This kind of behaviour has been associated with exploitation of WinRAR path traversal vulnerability CVE-2025-6218 or CVE-2025-8088.

Techniques: T1547.001

Suspicious PowerShell In Registry Run Keys mediumtest

Author: frack113, Florian Roth (Nextron Systems) · 2022-03-17 (modified 2025-07-18) · logsource: product=windows category=registry_set · 8d85cf08-bf97-4260-ba49-986a2a65129c

Detects potential PowerShell commands or code within registry run keys

Techniques: T1547.001

User Shell Folders Registry Modification via CommandLine highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-01-05 · logsource: product=windows category=process_creation · 8f3ab69a-aa22-4943-aa58-e0a52fdf6818

Detects modifications to User Shell Folders registry values via reg.exe or PowerShell, which could indicate persistence attempts. Attackers may modify User Shell Folders registry values to point to malicious executables or scripts that will be executed during startup. This technique is often used to maintain persistence on a compromised system by ensuring that malicious payloads are executed automatically.

Techniques: T1547.001 T1112

Potential Startup Shortcut Persistence Via PowerShell.EXE hightest

Author: Christopher Peacock '@securepeacock', SCYTHE · 2021-10-24 (modified 2023-02-23) · logsource: product=windows category=file_event · 92fa78e7-4d39-45f1-91a3-8b23f3f1088d

Detects PowerShell writing startup shortcuts. This procedure was highlighted in Red Canary Intel Insights Oct. 2021, "We frequently observe adversaries using PowerShell to write malicious .lnk files into the startup directory to establish persistence. Accordingly, this detection opportunity is likely to identify persistence mechanisms in multiple threats. In the context of Yellow Cockatoo, this persistence mechanism eventually launches the command-line script that leads to the installation of a malicious DLL"

Techniques: T1547.001

Modify User Shell Folders Startup Value hightest

Author: frack113, Swachchhanda Shrawan Poudel (Nextron Systems) · 2022-10-01 (modified 2026-01-05) · logsource: product=windows category=registry_set · 9c226817-8dc9-46c2-a58d-66655aafd7dc

Detect modification of the User Shell Folders registry values for Startup or Common Startup which could indicate persistence attempts. Attackers may modify User Shell Folders registry keys to point to malicious executables or scripts that will be executed during startup. This technique is often used to maintain persistence on a compromised system by ensuring that the malicious payload is executed automatically.

Techniques: T1547.001

Suspicious Run Key from Download hightest

Author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poude (Nextron Systems) · 2019-10-01 (modified 2025-02-17) · logsource: product=windows category=registry_event · 9c5037d1-c568-49b3-88c7-9846a5bdc2be

Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories

Techniques: T1547.001

Classes Autorun Keys Modification mediumtest

Detects modification of Windows Registry Classes keys used for persistence. Adversaries modify these autostart extensibility points (ASEP) to execute malicious code when file types are opened or actions are performed. Various legitimate software also uses these keys. Currently, this rule only filters out known legitimate software paths, thus it is recommended to review and tune filters for your environment to reduce false positives before deploying to production.

Techniques: T1547.001

Internet Explorer Autorun Keys Modification mediumtest

Detects modification of autostart extensibility point (ASEP) in registry.

Techniques: T1547.001

Wow6432Node CurrentVersion Autorun Keys Modification mediumtest

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) · 2019-10-25 (modified 2025-12-08) · logsource: product=windows category=registry_set · b29aed60-ebd1-442b-9cb5-16a1d0324adb

Detects modification of autostart extensibility point (ASEP) in registry.

Techniques: T1547.001

Registry Persistence via Explorer Run Key hightest

Author: Florian Roth (Nextron Systems), oscd.community · 2018-07-18 (modified 2023-12-11) · logsource: product=windows category=registry_set · b7916c2a-fa2f-4795-9477-32b731f70f11

Detects a possible persistence mechanism using RUN key for Windows Explorer and pointing to a suspicious folder

Techniques: T1547.001

Windows Event Log Access Tampering Via Registry highexperimental

Author: X__Junior · 2025-01-16 (modified 2025-08-16) · logsource: product=windows category=registry_set · ba226dcf-d390-4642-b9af-b534872f1156

Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Definition Language (SDDL) string, as modifications to these values can restrict access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel. Upon execution, the user shouldn't be able to access the event log channel via the event viewer or via utilities such as "Get-EventLog" or "wevtutil".

Techniques: T1547.001 T1112

Office Autorun Keys Modification mediumtest

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) · 2019-10-25 (modified 2026-01-09) · logsource: product=windows category=registry_set · baecf8fb-edbf-429f-9ade-31fc3f22b970

Detects modification of autostart extensibility point (ASEP) in registry. Adversaries may modify these keys to execute malicious code when Office files are opened. There are various legitimate add-ins that also use these keys and this filter list might not be exhaustive. Thus, it is recommended to review and tune filters for your environment to reduce false positives before deploying to production.

Techniques: T1547.001

Kapeka Backdoor Autorun Persistence hightest

Author: Swachchhanda Shrawan Poudel · 2024-07-03 · logsource: product=windows category=registry_set · c0c67b21-eb8a-4c84-a395-40473ec3b482

Detects the setting of a new value in the Autorun key that is used by the Kapeka backdoor for persistence.

Techniques: T1547.001

Potential Suspicious Activity Using SeCEdit mediumtest

Author: Janantha Marasinghe · 2022-11-18 (modified 2022-12-30) · logsource: product=windows category=process_creation · c2c76b77-32be-4d1f-82c9-7e544bdfe0eb

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

Techniques: T1685.001 T1547.001 T1505.005 T1556.002 T1685 T1574.007 T1564.002 T1546.008 T1546.007 T1547.014 T1547.010 T1547.002 T1557 T1082

Potential Ryuk Ransomware Activity highstable

Author: Florian Roth (Nextron Systems), Vasiliy Burov, Nasreddine Bencherchali (Nextron Systems) · 2019-12-16 (modified 2023-02-03) · logsource: product=windows category=process_creation · c37510b8-2107-4b78-aa32-72f251e7a844

Detects Ryuk ransomware activity

Techniques: T1547.001

Suspicious Autorun Registry Modified via WMI highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-02-17 · logsource: product=windows category=process_creation · c80e66d8-1780-48a9-b412-46663fd21ac0

Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware.

Techniques: T1547.001 T1047

Potential KamiKakaBot Activity - Winlogon Shell Persistence hightest

Author: Nasreddine Bencherchali (Nextron Systems), X__Junior · 2024-03-22 · logsource: product=windows category=registry_set · c9b86500-1ec2-4de6-9120-d744c8fb5caf

Detects changes to the "Winlogon" registry key where a process will set the value of the "Shell" to a value that was observed being used by KamiKakaBot samples in order to achieve persistence.

Techniques: T1547.001

CurrentVersion NT Autorun Keys Modification mediumtest

Detects modification of autostart extensibility point (ASEP) in registry.

Techniques: T1547.001

WinSock2 Autorun Keys Modification mediumtest

Detects modification of autostart extensibility point (ASEP) in registry.

Techniques: T1547.001

Forest Blizzard APT - Custom Protocol Handler DLL Registry Set hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2024-04-23 · logsource: product=windows category=registry_set · d807056b-0e00-4cec-b7f8-b8b7518e382b

Detects the setting of the DLL that handles the custom protocol handler. Seen being created by Forest Blizzard APT as reported by MSFT.

Techniques: T1547.001

Potential Persistence Attempt Via Run Keys Using Reg.EXE mediumtest

Author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) · 2021-06-28 (modified 2025-02-17) · logsource: product=windows category=process_creation · de587dce-915e-4218-aac4-835ca6af6f70

Detects suspicious command line reg.exe tool adding key to RUN key in Registry

Techniques: T1547.001

System Scripts Autorun Keys Modification mediumtest

Detects modification of autostart extensibility point (ASEP) in registry.

Techniques: T1547.001

Common Autorun Keys Modification mediumtest

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name) · 2019-10-25 (modified 2025-10-22) · logsource: product=windows category=registry_set · f59c3faf-50f3-464b-9f4c-1b67ab512d99

Detects modification of autostart extensibility point (ASEP) in registry.

Techniques: T1547.001

Narrator's Feedback-Hub Persistence hightest

Author: Dmitriy Lifanov, oscd.community · 2019-10-25 (modified 2022-03-26) · logsource: product=windows category=registry_event · f663a6d9-9d1b-49b8-b2b1-0637914d199a

Detects abusing Windows 10 Narrator's Feedback-Hub

Techniques: T1547.001

CurrentControlSet Autorun Keys Modification mediumtest

Detects modification of autostart extensibility point (ASEP) in registry.

Techniques: T1547.001

Rules tagged at the parent level (attack.t1547) 7

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

Startup/Logon Script Added to Group Policy Object mediumtest

Author: Elastic, Josh Nickels, Marius Rothenbücher · 2024-09-06 · logsource: product=windows service=security · 123e4e6d-b123-48f8-b261-7214938acaf0

Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.

Techniques: T1484.001 T1547

Registry Persistence Mechanisms in Recycle Bin hightest

Author: frack113 · 2021-11-18 (modified 2022-12-06) · logsource: product=windows category=registry_event · 277efb8f-60be-4f10-b4d3-037802f37167

Detects persistence registry keys for Recycle Bin

Techniques: T1547

Atbroker Registry Change mediumtest

Author: Mateusz Wydra, oscd.community · 2020-10-13 (modified 2023-01-19) · logsource: product=windows category=registry_event · 9577edbb-851f-4243-8c91-1d5b50c1a39b

Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'

Techniques: T1218 T1547

Suspicious Driver Install by pnputil.exe mediumtest

Author: Hai Vaknin @LuxNoBulIshit, Avihay eldad @aloneliassaf, Austin Songer @austinsonger · 2021-09-30 (modified 2022-10-09) · logsource: product=windows category=process_creation · a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1

Detects when a possible suspicious driver is being installed via pnputil.exe lolbin

Techniques: T1547

Potential RipZip Attack on Startup Folder hightest

Author: Greg (rule) · 2022-07-21 (modified 2023-01-05) · logsource: product=windows category=file_event · a6976974-ea6f-4e97-818e-ea08625c52cb

Detects a phishing attack which expands a ZIP file containing a malicious shortcut. If the victim expands the ZIP file via the explorer process, then the explorer process expands the malicious ZIP file and drops a malicious shortcut redirected to a backdoor into the Startup folder. Additionally, the file name of the malicious shortcut in Startup folder contains {0AFACED1-E828-11D1-9187-B532F1E9575D} meaning the folder shortcut operation.

Techniques: T1547

WINEKEY Registry Modification hightest

Author: omkar72 · 2020-10-30 (modified 2021-11-27) · logsource: product=windows category=registry_event · b98968aa-dbc0-4a9c-ac35-108363cbf8d5

Detects potential malicious modification of run keys by winekey or team9 backdoor

Techniques: T1547

Suspicious GrpConv Execution hightest

Author: Florian Roth (Nextron Systems) · 2022-05-19 · logsource: product=windows category=process_creation · f14e169e-9978-4c69-acb3-1cff8200bc36

Detects the suspicious execution of a utility to convert Windows 3.x .grp files or for persistence purposes by malicious software or actors

Techniques: T1547

T1547.001 Registry Run Keys / Startup Folder

KEV CVEs mapped to this technique · CTID Mappings Explorer

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1547.001

Rules tagged at the parent level (attack.t1547) 7

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1547.001`