T1547 Boot or Logon Autostart Execution

Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. MITRE ATT&CK

2 programs on CmdID 2 Sigma rules T1547 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK

T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

T1547.002Boot or Logon Autostart Execution: Authentication Package

T1547.006Boot or Logon Autostart Execution: Kernel Modules and Extensions

T1547.010Boot or Logon Autostart Execution: Port Monitors

T1547.014Boot or Logon Autostart Execution: Active Setup

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

pnputil.exeExecute update.exeExecute

Sigma rules tagged with it

process creation, the highest levels first

highSuspicious GrpConv ExecutionFlorian Roth (Nextron Systems) · Windows

mediumSuspicious Driver Install by pnputil.exeHai Vaknin @LuxNoBulIshit, Avihay eldad @aloneliassaf, Austin Songer @austinsonger · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Install a driver package from an INF file on the page for pnputil.exe

pnputil /add-driver path\to\driver.infIdentify

Add and install all INF files in a folder (including subdirectories) on the page for pnputil.exe

pnputil /add-driver path\to\folder\*.inf /subdirsIdentify

An example is here when CmdID’s reading of it names T1547: a Sigma rule it trips is tagged with it, or its abuse is documented as it.