CmdID

CmdID / Techniques / T1547

T1547.010 Boot or Logon Autostart Execution: Port Monitors

Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. MITRE ATT&CK

1 Sigma rule T1547.010 on attack.mitre.org

Part of

MITRE ATT&CK
T1547Boot or Logon Autostart Execution

Sigma rules tagged with it

process creation, the highest levels first
mediumPotential Suspicious Activity Using SeCEditJanantha Marasinghe · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

To incorporate changes required by the analysis process on the SecContoso.inf file, and then to direct the output to the existing file, SecAnalysisContosoFY11, without prompting, type on the page for secedit configure

secedit /configure /db C:\Security\FY11\SecDbContoso.sdb /cfg SecContoso.inf /overwrite /log C:\Security\FY11\SecAnalysisContosoFY11.xml /quietIdentify

To export the security database and the domain security policies to an inf file, and then import that file to a different database in order to replicate the security policy settings on another computer, type on the page for secedit export

secedit /export /db C:\Security\FY11\SecDbContoso.sdb /mergedpolicy /cfg SecContoso.inf /log C:\Security\FY11\SecAnalysisContosoFY11.log /quietIdentify

To export the security database and the domain security policies to an .inf file, and then to import that file to a different database to replicate the policy settings on another computer, type on the page for secedit import

secedit /export /db C:\Security\FY11\SecDbContoso.sdb /mergedpolicy /cfg NetworkShare\Policies\SecContoso.inf /log C:\Security\FY11\SecAnalysisContosoFY11.log /quietIdentify

An example is here when CmdID’s reading of it names T1547.010: a Sigma rule it trips is tagged with it, or its abuse is documented as it.