Which SIEM platforms have a T1547 detection rule?

df00tech provides T1547 (Boot or Logon Autostart Execution) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the T1547 detection?

The T1547 detection is rated high severity with medium confidence.

What are common false positives for T1547?

Common false positives for T1547 include: Software installations that register legitimate autostart entries in Run keys; Windows Updates or Group Policy changes modifying Winlogon or Shell Folders registry keys; Print driver installations that add legitimate port monitors or print processors.

T1547

Boot or Logon Autostart Execution

Q: What data sources are required to detect Boot or Logon Autostart Execution (T1547)?

Detecting Boot or Logon Autostart Execution requires the following data sources: Windows Registry: Windows Registry Key Modification, Windows Registry: Windows Registry Key Creation, Microsoft Defender for Endpoint.

Persistence Privilege Escalation Last updated: April 20, 2026

Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon, including automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel. Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.

What is T1547 Boot or Logon Autostart Execution?

Boot or Logon Autostart Execution (T1547) maps to the Persistence and Privilege Escalation tactics — the adversary is trying to maintain their foothold in MITRE ATT&CK.

This page provides production-ready detection logic for Boot or Logon Autostart Execution, covering the data sources and telemetry it touches: Windows Registry: Windows Registry Key Modification, Windows Registry: Windows Registry Key Creation, Microsoft Defender for Endpoint. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Persistence Privilege Escalation
Technique: T1547 Boot or Logon Autostart Execution
Canonical reference: https://attack.mitre.org/techniques/T1547/

Microsoft Sentinel / Defender

kusto

let RunKeyPaths = dynamic([
  "\\CurrentVersion\\Run",
  "\\CurrentVersion\\RunOnce",
  "\\CurrentVersion\\RunOnceEx",
  "\\CurrentVersion\\RunServices",
  "\\CurrentVersion\\RunServicesOnce",
  "\\CurrentVersion\\Policies\\Explorer\\Run",
  "\\CurrentVersion\\Winlogon",
  "\\Active Setup\\Installed Components",
  "\\Control\\Lsa\\Authentication Packages",
  "\\Control\\Lsa\\Security Packages",
  "\\Control\\Print\\Monitors",
  "\\Control\\Print\\Environments",
  "\\Services\\W32Time\\TimeProviders",
  "\\CurrentVersion\\Explorer\\Shell Folders",
  "\\CurrentVersion\\Explorer\\User Shell Folders"
]);
DeviceRegistryEvents
| where Timestamp > ago(24h)
| where ActionType in ("RegistryValueSet", "RegistryKeyCreated")
| where RegistryKey has_any (RunKeyPaths)
| project Timestamp, DeviceName, ActionType, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| sort by Timestamp desc

Broad detection for modifications to any Windows autostart registry locations including Run/RunOnce keys, Winlogon helpers, Active Setup, LSA packages, print monitors, and time providers. Uses DeviceRegistryEvents from Microsoft Defender for Endpoint to catch registry value sets and key creations across all known boot/logon autostart persistence paths.

high severity medium confidence

Data Sources

Windows Registry: Windows Registry Key Modification Windows Registry: Windows Registry Key Creation Microsoft Defender for Endpoint

Required Tables

DeviceRegistryEvents

False Positives

Software installations that register legitimate autostart entries in Run keys
Windows Updates or Group Policy changes modifying Winlogon or Shell Folders registry keys
Print driver installations that add legitimate port monitors or print processors
Enterprise IT tools (SCCM, Intune, GPO) deploying startup configurations

IBM QRadar (AQL)

sql

SELECT DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  username,
  QIDNAME(qid) AS event_name,
  "RegistryKey",
  "RegistryValueName",
  "RegistryValueData",
  "ProcessName",
  "ProcessCommandLine",
  LOGSOURCENAME(logsourceid) AS log_source
FROM events
WHERE LOGSOURCETYPENAME(devicetype) = 'Microsoft Windows Security Event Log'
  AND qid IN (
    SELECT qid FROM QIDmap WHERE name LIKE '%Registry%'
  )
  AND LOWER("RegistryKey") MATCHES '.*\\(currentversion\\run|currentversion\\runonce|currentversion\\runonceex|currentversion\\runservices|currentversion\\runservicesonce|currentversion\\policies\\explorer\\run|currentversion\\winlogon|active setup\\installed components|control\\lsa|control\\print\\monitors|control\\print\\environments|services\\w32time\\timeproviders|explorer\\shell folders|explorer\\user shell folders).*'
  AND LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND devicetime > (CURRENT_TIMESTAMP - 86400000)
ORDER BY devicetime DESC

Detects creation and modification of Windows autostart registry keys associated with T1547 persistence techniques. Queries Windows Security Event Log and Sysmon sources in QRadar for registry events targeting Run keys, Winlogon, LSA packages, Print Monitors, and Shell Folder paths.

high severity medium confidence

Data Sources

Windows Security Event Log (via QRadar WinCollect) Sysmon operational log forwarded to QRadar

Required Tables

events

False Positives

Software deployment tools such as SCCM or Intune may write to RunOnce keys to schedule post-reboot installation steps, generating high volumes of benign alerts during patch cycles
Security agents (EDR, antivirus) frequently register themselves in HKLM Run keys upon installation or version upgrade, which will match this detection
Legitimate IT automation scripts (PowerShell DSC, Ansible) managing Winlogon notification packages or LSA security packages will match when run by privileged accounts

Sumo Logic CSE

sql

_sourceCategory="windows/sysmon" OR _sourceCategory="windows/security"
| where EventID in ("12", "13", "14", "4657")
| where TargetObject matches "*\\CurrentVersion\\Run*"
  OR TargetObject matches "*\\CurrentVersion\\RunOnce*"
  OR TargetObject matches "*\\CurrentVersion\\RunOnceEx*"
  OR TargetObject matches "*\\CurrentVersion\\RunServices*"
  OR TargetObject matches "*\\CurrentVersion\\RunServicesOnce*"
  OR TargetObject matches "*\\CurrentVersion\\Policies\\Explorer\\Run*"
  OR TargetObject matches "*\\CurrentVersion\\Winlogon*"
  OR TargetObject matches "*\\Active Setup\\Installed Components*"
  OR TargetObject matches "*\\Control\\Lsa\\Authentication Packages*"
  OR TargetObject matches "*\\Control\\Lsa\\Security Packages*"
  OR TargetObject matches "*\\Control\\Print\\Monitors*"
  OR TargetObject matches "*\\Control\\Print\\Environments*"
  OR TargetObject matches "*\\Services\\W32Time\\TimeProviders*"
  OR TargetObject matches "*\\Explorer\\Shell Folders*"
  OR TargetObject matches "*\\Explorer\\User Shell Folders*"
| eval action = if(EventID == "12", "KeyCreated", if(EventID == "13", "ValueSet", if(EventID == "14", "KeyRenamed", "RegistryModified")))
| fields _messageTime, Computer, action, TargetObject, Details, Image, User
| sort by _messageTime desc

Detects Sysmon registry events (EventID 12/13/14) and Windows Security Event 4657 targeting known autostart execution registry paths used in T1547 persistence. Covers Run keys, Winlogon, LSA authentication/security packages, Print Monitors, and Explorer Shell Folders.

high severity high confidence

Data Sources

Sysmon via Sumo Logic Windows source (EventID 12, 13, 14) Windows Security log via Sumo Logic (EventID 4657)

Required Tables

windows/sysmon windows/security

False Positives

Windows Update and Windows Installer (msiexec.exe) routinely modify RunOnce keys to schedule cleanup or completion tasks after patch installation, producing high false positive volumes during Patch Tuesday windows
Enterprise software such as Microsoft Teams, Zoom, or Slack silently adds or updates Run key entries for auto-launch on user login, generating benign events at scale
IT asset management and remote support tools (e.g., Dameware, Bomgar) may register themselves in Winlogon notification packages and Active Setup keys during deployment

Google Chronicle / SecOps

yaral

rule t1547_boot_logon_autostart_registry {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects registry creation or modification events targeting Windows boot/logon autostart execution locations (T1547). Covers Run keys, RunOnce, Winlogon, LSA package registration, Print Monitor DLL paths, and Shell Folder redirections."
    mitre_attack_tactic = "Persistence, Privilege Escalation"
    mitre_attack_technique = "T1547"
    severity = "HIGH"
    confidence = "HIGH"

  events:
    $e.metadata.event_type = "REGISTRY_MODIFICATION"
    (
      re.regex($e.target.registry.registry_key, `(?i)\\CurrentVersion\\Run(Once(Ex)?|Services(Once)?)?\\`) or
      re.regex($e.target.registry.registry_key, `(?i)\\CurrentVersion\\Policies\\Explorer\\Run`) or
      re.regex($e.target.registry.registry_key, `(?i)\\CurrentVersion\\Winlogon`) or
      re.regex($e.target.registry.registry_key, `(?i)\\Active Setup\\Installed Components`) or
      re.regex($e.target.registry.registry_key, `(?i)\\Control\\Lsa\\(Authentication|Security) Packages`) or
      re.regex($e.target.registry.registry_key, `(?i)\\Control\\Print\\(Monitors|Environments)`) or
      re.regex($e.target.registry.registry_key, `(?i)\\Services\\W32Time\\TimeProviders`) or
      re.regex($e.target.registry.registry_key, `(?i)\\Explorer\\(User )?Shell Folders`)
    )

  condition:
    $e
}

Chronicle YARA-L 2.0 rule detecting REGISTRY_MODIFICATION events on Windows autostart execution registry key paths associated with T1547. Matches registry writes to Run keys, Winlogon entries, LSA packages, Print Monitors, W32Time providers, and Shell Folder redirections via UDM normalized registry telemetry.

high severity high confidence

Data Sources

Windows endpoint telemetry via Chronicle Forwarder (Sysmon or EDR) Google Chronicle UDM REGISTRY_MODIFICATION events

Required Tables

UDM events with metadata.event_type = REGISTRY_MODIFICATION

False Positives

Scheduled system tasks and Windows components (e.g., Task Scheduler, Windows Defender) modify Winlogon-related keys during normal operation, particularly after cumulative updates
Application virtualisation platforms (App-V, VMware ThinApp) manipulate Shell Folder registry values as part of app launch sequencing, generating benign matches
Print server administrators deploying print monitor DLLs for enterprise printing solutions (Pharos, PaperCut) will write to Control\Print\Monitors during driver provisioning

Sigma rule & cross-platform mapping

The detection logic for Boot or Logon Autostart Execution (T1547) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1547 Sigma rules on detection.fyi

Platform-specific guides for T1547

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-04-20 Research depth: deep

References (5)

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Add Registry Run Key for Persistence
Expected signal: Sysmon Event ID 13: Registry value set on HKCU\Software\Microsoft\Windows\CurrentVersion\Run with value name 'df00tech-test'. DeviceRegistryEvents with ActionType 'RegistryValueSet'.
Test 2Drop File in Startup Folder
Expected signal: Sysmon Event ID 11: FileCreate in the Startup directory. DeviceFileEvents with ActionType 'FileCreated' in the Startup folder path.
Test 3Modify Winlogon Shell Value
Expected signal: Sysmon Event ID 13: Registry value set on Winlogon\Shell. DeviceRegistryEvents with RegistryKey containing 'Winlogon' and RegistryValueName 'Shell'.

Response Playbook

Triage

Identify which specific autostart mechanism was modified — Run key, Winlogon, Active Setup, LSA, print spooler, or time provider. Each has different severity implications.
Examine the registry value data — does it point to a known legitimate executable or an unusual path (e.g., temp directories, user writable locations, encoded paths)?
Check the initiating process — was the registry modification made by an expected installer, GPO engine (svchost.exe -k netsvcs), or an unusual process like cmd.exe, powershell.exe, or a script host?
Verify the user context — is this a standard user, service account, or administrator? LSA and print spooler modifications require elevated privileges.
Cross-reference with recent software deployments or change tickets to determine if the change is authorized.
Look for temporal clustering — multiple autostart modifications in a short window may indicate an automated attack framework.

Containment

If malicious: remove the registry entry immediately using reg delete or PowerShell Remove-ItemProperty
If the referenced binary is on disk: quarantine the file and collect a hash for IOC sharing
If LSA or Winlogon modifications detected: isolate the endpoint — these indicate high-privilege compromise
If multiple endpoints affected: assess for lateral movement and consider domain-wide credential reset
Enable LSA Protection (RunAsPPL) on affected endpoints if not already configured

Evidence Collection

Registry export of the modified key and all subkeys using reg export
File hash (SHA256) and metadata of the referenced binary
Sysmon Event IDs 12/13/14 for the registry modification timeline
Process creation logs (Sysmon EID 1 / Security EID 4688) for the initiating process tree
Autoruns output (Sysinternals) for a complete view of all autostart locations on the endpoint
Memory dump if a rootkit or in-memory-only payload is suspected

Escalation Criteria

! Any modification to LSA Authentication Packages or Security Packages — indicates credential theft capability
! Winlogon Shell or Userinit modification — indicates boot-level persistence with potential for all-user impact
! Registry value pointing to a binary in a temporary directory, recycle bin, or user-writable system path
! Multiple distinct autostart mechanisms modified on the same endpoint (defense in depth persistence)
! Same autostart modification observed across multiple endpoints simultaneously

Investigation Guide

Forensic Artifacts

> Registry: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and RunOnce
> Registry: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and RunOnce
> Registry: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon (Shell, Userinit, Notify)
> Registry: HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{GUID}\StubPath
> Registry: HKLM\SYSTEM\CurrentControlSet\Control\Lsa (Authentication Packages, Security Packages)
> Registry: HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors and Print Processors
> File System: C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
> File System: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
> Sysinternals Autoruns output comparing against known-good baseline

Tuning Guidance

This parent-level detection is intentionally broad and will generate significant volume. It is best used as a hunting query or for environments building initial visibility. For production alerting, deploy the sub-technique-specific detections (T1547.001 through T1547.015) which have more targeted logic and lower false positive rates. Start by baselining known-good autostart entries using Sysinternals Autoruns across your fleet. Exclude entries from trusted installers (msiexec.exe, TrustedInstaller.exe, SCCM client) and focus alerts on modifications from interactive processes (explorer.exe, cmd.exe, powershell.exe) or unusual parent processes.

Hunting Queries

Hunt for unique Run key values that appear on only one device — these are more likely malicious than values deployed widely by enterprise software.

Hunting — KQL

kql

DeviceRegistryEvents
| where Timestamp > ago(7d)
| where ActionType == "RegistryValueSet"
| where RegistryKey has "\\CurrentVersion\\Run"
| summarize Count=count(), Devices=dcount(DeviceName) by RegistryValueData
| where Devices == 1
| sort by Count asc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13 TargetObject="*\\CurrentVersion\\Run*"
| stats count as Count, dc(host) as Devices by Details
| where Devices == 1
| sort Count

Hunt for modifications to high-value autostart locations (Winlogon, LSA, Active Setup) by processes other than known Windows servicing components.

Hunting — KQL

kql

DeviceRegistryEvents
| where Timestamp > ago(7d)
| where ActionType == "RegistryValueSet"
| where RegistryKey has_any ("\\Winlogon", "\\Lsa", "\\Active Setup")
| where InitiatingProcessFileName !in~ ("msiexec.exe", "svchost.exe", "TiWorker.exe", "TrustedInstaller.exe")
| project Timestamp, DeviceName, RegistryKey, RegistryValueData, InitiatingProcessFileName
| sort by Timestamp desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13 (TargetObject="*\\Winlogon*" OR TargetObject="*\\Lsa\\*" OR TargetObject="*Active Setup*") NOT (Image="*\\msiexec.exe" OR Image="*\\svchost.exe" OR Image="*\\TiWorker.exe" OR Image="*\\TrustedInstaller.exe")
| table _time, host, TargetObject, Details, Image
| sort - _time

Hunt for new files created in the Startup folder — a common and simple persistence mechanism used by many malware families and threat actors.

Hunting — KQL

kql

DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath has "Start Menu\\Programs\\Startup"
| where ActionType == "FileCreated"
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by Timestamp desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 TargetFilename="*Start Menu\\Programs\\Startup*"
| table _time, host, TargetFilename, Image, User
| sort - _time

Atomic Red Team Tests

Test 1 Add Registry Run Key for Persistence

windows

Creates a Run key entry in HKCU that would execute calc.exe at user logon. This is the most common autostart persistence mechanism used by malware.

Command

powershell

reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v df00tech-test /t REG_SZ /d "C:\Windows\System32\calc.exe" /f

Cleanup

powershell

reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v df00tech-test /f

Expected Telemetry

Sysmon Event ID 13: Registry value set on HKCU\Software\Microsoft\Windows\CurrentVersion\Run with value name 'df00tech-test'. DeviceRegistryEvents with ActionType 'RegistryValueSet'.

Expected Detection

Alert fires on Run key path match. Both KQL and SPL queries will capture this event with the full registry path and value data.

Test 2 Drop File in Startup Folder

windows

Places a benign batch script in the current user's Startup folder. The script will execute at next logon. Many malware families use this simple persistence method.

Command

powershell

echo echo df00tech-test > "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\df00tech-test.bat"

Cleanup

powershell

del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\df00tech-test.bat"

Expected Telemetry

Sysmon Event ID 11: FileCreate in the Startup directory. DeviceFileEvents with ActionType 'FileCreated' in the Startup folder path.

Expected Detection

Hunting query for Startup folder file creation will detect this. The file creation event captures the full path and initiating process.

Test 3 Modify Winlogon Shell Value

windows

Modifies the Winlogon Shell registry value to append a secondary executable. This technique is used by sophisticated malware like Gazer (Turla) and LockBit to achieve boot-level persistence.

Command

powershell

reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, C:\Windows\System32\calc.exe" /f

Cleanup

powershell

reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe" /f

Expected Telemetry

Sysmon Event ID 13: Registry value set on Winlogon\Shell. DeviceRegistryEvents with RegistryKey containing 'Winlogon' and RegistryValueName 'Shell'.

Expected Detection

Alert fires on Winlogon registry path match. The detection captures the modified Shell value showing the appended executable.

Related Detections

Tactic Hubs

TA0003Persistence TA0004Privilege Escalation

Sub-techniques (14)

Related Techniques

T1547.001Registry Run Keys / Startup Folder T1547.004Winlogon Helper DLL T1547.002Authentication Package T1547.005Security Support Provider T1547.014Active Setup T1037Boot or Logon Initialization Scripts T1543Create or Modify System Process T1053.005Scheduled Task T1574Hijack Execution Flow T1112Modify Registry

What is T1547 Boot or Logon Autostart Execution?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for T1547

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Sub-techniques (14)

Related Techniques

Same Tactic: Persistence

Popular Detections

Get new detections in your inbox