T1547PersistencePrivilege Escalation

Boot or Logon Autostart Execution

Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon. These mechanisms may include automatically executing programs that are placed in specially designated…

attack.mitre.org ↗

CVEs1

In 1

Reports0

Sub-techniques T1547.001Registry Run Keys / Startup Folder1 T1547.002Authentication Package T1547.003Time Providers T1547.004Winlogon Helper DLL T1547.005Security Support Provider T1547.006Kernel Modules and Extensions T1547.007Re-opened Applications T1547.008LSASS Driver T1547.009Shortcut Modification T1547.010Port Monitors T1547.012Print Processors T1547.013XDG Autostart Entries T1547.014Active Setup T1547.015Login Items

Detections

7 Sigma rules tagged T1547

Boot or Logon Autostart ExecutionT15477 general rules

Potential RipZip Attack on Startup Folderhightest
Registry Persistence Mechanisms in Recycle Binhightest
Suspicious GrpConv Executionhightest
WINEKEY Registry Modificationhightest
Atbroker Registry Changemediumtest
Startup/Logon Script Added to Group Policy Objectmediumtest
Suspicious Driver Install by pnputil.exemediumtest

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

CVEs linked to Boot or Logon Autostart Execution

1 CVE, by priority. Each link shows its badge.

CVE-2023-2533PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability
PaperCut · NG/MFKEVPublic exploitHigh · 8.8T1566.002Spearphishing Link T1059Command and Scripting Interpreter+1 more
MITRE CTID mapping of the KEV entry · primary impact
28.8%Top 1.9%
68.8priority

Linked through a sub-technique

1 more

CVE-2022-22047Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability
Microsoft · WindowsKEVHigh · 7.8T1078Valid Accounts T1059Command and Scripting Interpreter+2 more
18.8%Top 2.7%
62.9priority