T1547 Google Chronicle · YARA-L

Detect Boot or Logon Autostart Execution in Google Chronicle

Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon, including automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel. Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.

MITRE ATT&CK

Tactic
Persistence Privilege Escalation
Technique
T1547 Boot or Logon Autostart Execution
Canonical reference
https://attack.mitre.org/techniques/T1547/

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule t1547_boot_logon_autostart_registry {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects registry creation or modification events targeting Windows boot/logon autostart execution locations (T1547). Covers Run keys, RunOnce, Winlogon, LSA package registration, Print Monitor DLL paths, and Shell Folder redirections."
    mitre_attack_tactic = "Persistence, Privilege Escalation"
    mitre_attack_technique = "T1547"
    severity = "HIGH"
    confidence = "HIGH"

  events:
    $e.metadata.event_type = "REGISTRY_MODIFICATION"
    (
      re.regex($e.target.registry.registry_key, `(?i)\\CurrentVersion\\Run(Once(Ex)?|Services(Once)?)?\\`) or
      re.regex($e.target.registry.registry_key, `(?i)\\CurrentVersion\\Policies\\Explorer\\Run`) or
      re.regex($e.target.registry.registry_key, `(?i)\\CurrentVersion\\Winlogon`) or
      re.regex($e.target.registry.registry_key, `(?i)\\Active Setup\\Installed Components`) or
      re.regex($e.target.registry.registry_key, `(?i)\\Control\\Lsa\\(Authentication|Security) Packages`) or
      re.regex($e.target.registry.registry_key, `(?i)\\Control\\Print\\(Monitors|Environments)`) or
      re.regex($e.target.registry.registry_key, `(?i)\\Services\\W32Time\\TimeProviders`) or
      re.regex($e.target.registry.registry_key, `(?i)\\Explorer\\(User )?Shell Folders`)
    )

  condition:
    $e
}
high severity high confidence

Chronicle YARA-L 2.0 rule detecting REGISTRY_MODIFICATION events on Windows autostart execution registry key paths associated with T1547. Matches registry writes to Run keys, Winlogon entries, LSA packages, Print Monitors, W32Time providers, and Shell Folder redirections via UDM normalized registry telemetry.

Data Sources

Windows endpoint telemetry via Chronicle Forwarder (Sysmon or EDR)Google Chronicle UDM REGISTRY_MODIFICATION events

Required Tables

UDM events with metadata.event_type = REGISTRY_MODIFICATION

False Positives & Tuning

  • Scheduled system tasks and Windows components (e.g., Task Scheduler, Windows Defender) modify Winlogon-related keys during normal operation, particularly after cumulative updates
  • Application virtualisation platforms (App-V, VMware ThinApp) manipulate Shell Folder registry values as part of app launch sequencing, generating benign matches
  • Print server administrators deploying print monitor DLLs for enterprise printing solutions (Pharos, PaperCut) will write to Control\Print\Monitors during driver provisioning

Other platforms for T1547

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 Add Registry Run Key for Persistence

    Expected signal: Sysmon Event ID 13: Registry value set on HKCU\Software\Microsoft\Windows\CurrentVersion\Run with value name 'df00tech-test'. DeviceRegistryEvents with ActionType 'RegistryValueSet'.

  2. Test 2 Drop File in Startup Folder

    Expected signal: Sysmon Event ID 11: FileCreate in the Startup directory. DeviceFileEvents with ActionType 'FileCreated' in the Startup folder path.

  3. Test 3 Modify Winlogon Shell Value

    Expected signal: Sysmon Event ID 13: Registry value set on Winlogon\Shell. DeviceRegistryEvents with RegistryKey containing 'Winlogon' and RegistryValueName 'Shell'.

Last updated: 2026-04-20 Research depth: deep
References (5)

Response Playbook

Triage

  1. Identify which specific autostart mechanism was modified — Run key, Winlogon, Active Setup, LSA, print spooler, or time provider. Each has different severity implications.
  2. Examine the registry value data — does it point to a known legitimate executable or an unusual path (e.g., temp directories, user writable locations, encoded paths)?
  3. Check the initiating process — was the registry modification made by an expected installer, GPO engine (svchost.exe -k netsvcs), or an unusual process like cmd.exe, powershell.exe, or a script host?
  4. Verify the user context — is this a standard user, service account, or administrator? LSA and print spooler modifications require elevated privileges.
  5. Cross-reference with recent software deployments or change tickets to determine if the change is authorized.
  6. Look for temporal clustering — multiple autostart modifications in a short window may indicate an automated attack framework.

Containment

  1. If malicious: remove the registry entry immediately using reg delete or PowerShell Remove-ItemProperty
  2. If the referenced binary is on disk: quarantine the file and collect a hash for IOC sharing
  3. If LSA or Winlogon modifications detected: isolate the endpoint — these indicate high-privilege compromise
  4. If multiple endpoints affected: assess for lateral movement and consider domain-wide credential reset
  5. Enable LSA Protection (RunAsPPL) on affected endpoints if not already configured

Evidence Collection

  1. Registry export of the modified key and all subkeys using reg export
  2. File hash (SHA256) and metadata of the referenced binary
  3. Sysmon Event IDs 12/13/14 for the registry modification timeline
  4. Process creation logs (Sysmon EID 1 / Security EID 4688) for the initiating process tree
  5. Autoruns output (Sysinternals) for a complete view of all autostart locations on the endpoint
  6. Memory dump if a rootkit or in-memory-only payload is suspected

Escalation Criteria

  • !Any modification to LSA Authentication Packages or Security Packages — indicates credential theft capability
  • !Winlogon Shell or Userinit modification — indicates boot-level persistence with potential for all-user impact
  • !Registry value pointing to a binary in a temporary directory, recycle bin, or user-writable system path
  • !Multiple distinct autostart mechanisms modified on the same endpoint (defense in depth persistence)
  • !Same autostart modification observed across multiple endpoints simultaneously

Investigation Guide

Related Techniques

T1547.001 — Registry Run Keys / Startup FolderT1547.004 — Winlogon Helper DLLT1547.002 — Authentication PackageT1547.005 — Security Support ProviderT1547.014 — Active SetupT1037 — Boot or Logon Initialization ScriptsT1543 — Create or Modify System ProcessT1053.005 — Scheduled TaskT1574 — Hijack Execution FlowT1112 — Modify Registry

Forensic Artifacts

  • >Registry: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and RunOnce
  • >Registry: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and RunOnce
  • >Registry: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon (Shell, Userinit, Notify)
  • >Registry: HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{GUID}\StubPath
  • >Registry: HKLM\SYSTEM\CurrentControlSet\Control\Lsa (Authentication Packages, Security Packages)
  • >Registry: HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors and Print Processors
  • >File System: C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
  • >File System: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
  • >Sysinternals Autoruns output comparing against known-good baseline

Tuning Guidance

This parent-level detection is intentionally broad and will generate significant volume. It is best used as a hunting query or for environments building initial visibility. For production alerting, deploy the sub-technique-specific detections (T1547.001 through T1547.015) which have more targeted logic and lower false positive rates. Start by baselining known-good autostart entries using Sysinternals Autoruns across your fleet. Exclude entries from trusted installers (msiexec.exe, TrustedInstaller.exe, SCCM client) and focus alerts on modifications from interactive processes (explorer.exe, cmd.exe, powershell.exe) or unusual parent processes.

Hunting Queries

Hunt for unique Run key values that appear on only one device — these are more likely malicious than values deployed widely by enterprise software.

Hunting — KQL
kql 
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where ActionType == "RegistryValueSet"
| where RegistryKey has "\\CurrentVersion\\Run"
| summarize Count=count(), Devices=dcount(DeviceName) by RegistryValueData
| where Devices == 1
| sort by Count asc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13 TargetObject="*\\CurrentVersion\\Run*"
| stats count as Count, dc(host) as Devices by Details
| where Devices == 1
| sort Count

Hunt for modifications to high-value autostart locations (Winlogon, LSA, Active Setup) by processes other than known Windows servicing components.

Hunting — KQL
kql 
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where ActionType == "RegistryValueSet"
| where RegistryKey has_any ("\\Winlogon", "\\Lsa", "\\Active Setup")
| where InitiatingProcessFileName !in~ ("msiexec.exe", "svchost.exe", "TiWorker.exe", "TrustedInstaller.exe")
| project Timestamp, DeviceName, RegistryKey, RegistryValueData, InitiatingProcessFileName
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13 (TargetObject="*\\Winlogon*" OR TargetObject="*\\Lsa\\*" OR TargetObject="*Active Setup*") NOT (Image="*\\msiexec.exe" OR Image="*\\svchost.exe" OR Image="*\\TiWorker.exe" OR Image="*\\TrustedInstaller.exe")
| table _time, host, TargetObject, Details, Image
| sort - _time

Hunt for new files created in the Startup folder — a common and simple persistence mechanism used by many malware families and threat actors.

Hunting — KQL
kql 
DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath has "Start Menu\\Programs\\Startup"
| where ActionType == "FileCreated"
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 TargetFilename="*Start Menu\\Programs\\Startup*"
| table _time, host, TargetFilename, Image, User
| sort - _time

Atomic Red Team Tests

Test 1 Add Registry Run Key for Persistence
windows

Creates a Run key entry in HKCU that would execute calc.exe at user logon. This is the most common autostart persistence mechanism used by malware.

Command

powershell 
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v df00tech-test /t REG_SZ /d "C:\Windows\System32\calc.exe" /f

Cleanup

powershell 
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v df00tech-test /f

Expected Telemetry

Sysmon Event ID 13: Registry value set on HKCU\Software\Microsoft\Windows\CurrentVersion\Run with value name 'df00tech-test'. DeviceRegistryEvents with ActionType 'RegistryValueSet'.

Expected Detection

Alert fires on Run key path match. Both KQL and SPL queries will capture this event with the full registry path and value data.

Test 2 Drop File in Startup Folder
windows

Places a benign batch script in the current user's Startup folder. The script will execute at next logon. Many malware families use this simple persistence method.

Command

powershell 
echo echo df00tech-test > "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\df00tech-test.bat"

Cleanup

powershell 
del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\df00tech-test.bat"

Expected Telemetry

Sysmon Event ID 11: FileCreate in the Startup directory. DeviceFileEvents with ActionType 'FileCreated' in the Startup folder path.

Expected Detection

Hunting query for Startup folder file creation will detect this. The file creation event captures the full path and initiating process.

Test 3 Modify Winlogon Shell Value
windows

Modifies the Winlogon Shell registry value to append a secondary executable. This technique is used by sophisticated malware like Gazer (Turla) and LockBit to achieve boot-level persistence.

Command

powershell 
reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, C:\Windows\System32\calc.exe" /f

Cleanup

powershell 
reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe" /f

Expected Telemetry

Sysmon Event ID 13: Registry value set on Winlogon\Shell. DeviceRegistryEvents with RegistryKey containing 'Winlogon' and RegistryValueName 'Shell'.

Expected Detection

Alert fires on Winlogon registry path match. The detection captures the modified Shell value showing the appended executable.

Related Detections

Tactic Hubs

TA0003 Persistence TA0004 Privilege Escalation

Sub-techniques (14)

Related Techniques

T1547.001 Registry Run Keys / Startup Folder T1547.004 Winlogon Helper DLL T1547.002 Authentication Package T1547.005 Security Support Provider T1547.014 Active Setup T1037 Boot or Logon Initialization Scripts T1543 Create or Modify System Process T1053.005 Scheduled Task T1574 Hijack Execution Flow T1112 Modify Registry

Same Tactic: Persistence

Popular Detections