CmdID

CmdID / Techniques / T1547

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. MITRE ATT&CK

1 program on CmdID 7 Sigma rules T1547.001 on attack.mitre.org

Part of

MITRE ATT&CK
T1547Boot or Logon Autostart Execution

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
reg.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first
highPotential Ryuk Ransomware ActivityFlorian Roth (Nextron Systems), Vasiliy Burov, Nasreddine Bencherchali (Nextron Systems) · Windows
highSuspicious Autorun Registry Modified via WMISwachchhanda Shrawan Poudel (Nextron Systems) · Windows
highSuspicious VBScript UN2452 PatternFlorian Roth (Nextron Systems) · Windows
highUser Shell Folders Registry Modification via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
mediumDirect Autorun Keys ModificationVictor Sergeev, Daniil Yugoslavskiy, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows
mediumPotential Persistence Attempt Via Run Keys Using Reg.EXEFlorian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) · Windows
mediumPotential Suspicious Activity Using SeCEditJanantha Marasinghe · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

To incorporate changes required by the analysis process on the SecContoso.inf file, and then to direct the output to the existing file, SecAnalysisContosoFY11, without prompting, type on the page for secedit configure

secedit /configure /db C:\Security\FY11\SecDbContoso.sdb /cfg SecContoso.inf /overwrite /log C:\Security\FY11\SecAnalysisContosoFY11.xml /quietIdentify

To export the security database and the domain security policies to an inf file, and then import that file to a different database in order to replicate the security policy settings on another computer, type on the page for secedit export

secedit /export /db C:\Security\FY11\SecDbContoso.sdb /mergedpolicy /cfg SecContoso.inf /log C:\Security\FY11\SecAnalysisContosoFY11.log /quietIdentify

To export the security database and the domain security policies to an .inf file, and then to import that file to a different database to replicate the policy settings on another computer, type on the page for secedit import

secedit /export /db C:\Security\FY11\SecDbContoso.sdb /mergedpolicy /cfg NetworkShare\Policies\SecContoso.inf /log C:\Security\FY11\SecAnalysisContosoFY11.log /quietIdentify

An example is here when CmdID’s reading of it names T1547.001: a Sigma rule it trips is tagged with it, or its abuse is documented as it.