T1547 Elastic Security · Elastic

Detect Boot or Logon Autostart Execution in Elastic Security

Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon, including automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel. Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.

MITRE ATT&CK

Tactic
Persistence Privilege Escalation
Technique
T1547 Boot or Logon Autostart Execution
Canonical reference
https://attack.mitre.org/techniques/T1547/

Elastic Detection Query

Elastic Security (Elastic)
eql 
registry where event.type in ("creation", "change") and registry.path : (
  "*\\CurrentVersion\\Run\\*",
  "*\\CurrentVersion\\RunOnce\\*",
  "*\\CurrentVersion\\RunOnceEx\\*",
  "*\\CurrentVersion\\RunServices\\*",
  "*\\CurrentVersion\\RunServicesOnce\\*",
  "*\\CurrentVersion\\Policies\\Explorer\\Run\\*",
  "*\\CurrentVersion\\Winlogon\\*",
  "*\\Active Setup\\Installed Components\\*",
  "*\\Control\\Lsa\\Authentication Packages",
  "*\\Control\\Lsa\\Security Packages",
  "*\\Control\\Print\\Monitors\\*",
  "*\\Control\\Print\\Environments\\*",
  "*\\Services\\W32Time\\TimeProviders\\*",
  "*\\CurrentVersion\\Explorer\\Shell Folders\\*",
  "*\\CurrentVersion\\Explorer\\User Shell Folders\\*"
)
high severity high confidence

Detects registry write and creation events targeting common Windows autostart execution locations used by adversaries for persistence and privilege escalation (T1547). Monitors Run keys, Winlogon entries, LSA authentication/security package registrations, Print Monitor DLL paths, and Shell Folder redirections.

Data Sources

Windows Registry via Elastic Agent / Winlogbeat with Sysmon

Required Tables

logs-endpoint.events.registry-*winlogbeat-*

False Positives & Tuning

  • Legitimate software installers (e.g., antivirus, enterprise agents, Microsoft Office) routinely write to Run and RunOnce keys during installation or update cycles
  • Group Policy application may rewrite Winlogon and Shell Folder registry values during policy refresh, especially at login or machine startup
  • Print driver installation by administrators writes to Control\Print\Monitors and Environments registry paths, triggering alerts during driver deployment

Other platforms for T1547

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 Add Registry Run Key for Persistence

    Expected signal: Sysmon Event ID 13: Registry value set on HKCU\Software\Microsoft\Windows\CurrentVersion\Run with value name 'df00tech-test'. DeviceRegistryEvents with ActionType 'RegistryValueSet'.

  2. Test 2 Drop File in Startup Folder

    Expected signal: Sysmon Event ID 11: FileCreate in the Startup directory. DeviceFileEvents with ActionType 'FileCreated' in the Startup folder path.

  3. Test 3 Modify Winlogon Shell Value

    Expected signal: Sysmon Event ID 13: Registry value set on Winlogon\Shell. DeviceRegistryEvents with RegistryKey containing 'Winlogon' and RegistryValueName 'Shell'.

Last updated: 2026-04-20 Research depth: deep
References (5)

Response Playbook

Triage

  1. Identify which specific autostart mechanism was modified — Run key, Winlogon, Active Setup, LSA, print spooler, or time provider. Each has different severity implications.
  2. Examine the registry value data — does it point to a known legitimate executable or an unusual path (e.g., temp directories, user writable locations, encoded paths)?
  3. Check the initiating process — was the registry modification made by an expected installer, GPO engine (svchost.exe -k netsvcs), or an unusual process like cmd.exe, powershell.exe, or a script host?
  4. Verify the user context — is this a standard user, service account, or administrator? LSA and print spooler modifications require elevated privileges.
  5. Cross-reference with recent software deployments or change tickets to determine if the change is authorized.
  6. Look for temporal clustering — multiple autostart modifications in a short window may indicate an automated attack framework.

Containment

  1. If malicious: remove the registry entry immediately using reg delete or PowerShell Remove-ItemProperty
  2. If the referenced binary is on disk: quarantine the file and collect a hash for IOC sharing
  3. If LSA or Winlogon modifications detected: isolate the endpoint — these indicate high-privilege compromise
  4. If multiple endpoints affected: assess for lateral movement and consider domain-wide credential reset
  5. Enable LSA Protection (RunAsPPL) on affected endpoints if not already configured

Evidence Collection

  1. Registry export of the modified key and all subkeys using reg export
  2. File hash (SHA256) and metadata of the referenced binary
  3. Sysmon Event IDs 12/13/14 for the registry modification timeline
  4. Process creation logs (Sysmon EID 1 / Security EID 4688) for the initiating process tree
  5. Autoruns output (Sysinternals) for a complete view of all autostart locations on the endpoint
  6. Memory dump if a rootkit or in-memory-only payload is suspected

Escalation Criteria

  • !Any modification to LSA Authentication Packages or Security Packages — indicates credential theft capability
  • !Winlogon Shell or Userinit modification — indicates boot-level persistence with potential for all-user impact
  • !Registry value pointing to a binary in a temporary directory, recycle bin, or user-writable system path
  • !Multiple distinct autostart mechanisms modified on the same endpoint (defense in depth persistence)
  • !Same autostart modification observed across multiple endpoints simultaneously

Investigation Guide

Related Techniques

T1547.001 — Registry Run Keys / Startup FolderT1547.004 — Winlogon Helper DLLT1547.002 — Authentication PackageT1547.005 — Security Support ProviderT1547.014 — Active SetupT1037 — Boot or Logon Initialization ScriptsT1543 — Create or Modify System ProcessT1053.005 — Scheduled TaskT1574 — Hijack Execution FlowT1112 — Modify Registry

Forensic Artifacts

  • >Registry: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and RunOnce
  • >Registry: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and RunOnce
  • >Registry: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon (Shell, Userinit, Notify)
  • >Registry: HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{GUID}\StubPath
  • >Registry: HKLM\SYSTEM\CurrentControlSet\Control\Lsa (Authentication Packages, Security Packages)
  • >Registry: HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors and Print Processors
  • >File System: C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
  • >File System: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
  • >Sysinternals Autoruns output comparing against known-good baseline

Tuning Guidance

This parent-level detection is intentionally broad and will generate significant volume. It is best used as a hunting query or for environments building initial visibility. For production alerting, deploy the sub-technique-specific detections (T1547.001 through T1547.015) which have more targeted logic and lower false positive rates. Start by baselining known-good autostart entries using Sysinternals Autoruns across your fleet. Exclude entries from trusted installers (msiexec.exe, TrustedInstaller.exe, SCCM client) and focus alerts on modifications from interactive processes (explorer.exe, cmd.exe, powershell.exe) or unusual parent processes.

Hunting Queries

Hunt for unique Run key values that appear on only one device — these are more likely malicious than values deployed widely by enterprise software.

Hunting — KQL
kql 
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where ActionType == "RegistryValueSet"
| where RegistryKey has "\\CurrentVersion\\Run"
| summarize Count=count(), Devices=dcount(DeviceName) by RegistryValueData
| where Devices == 1
| sort by Count asc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13 TargetObject="*\\CurrentVersion\\Run*"
| stats count as Count, dc(host) as Devices by Details
| where Devices == 1
| sort Count

Hunt for modifications to high-value autostart locations (Winlogon, LSA, Active Setup) by processes other than known Windows servicing components.

Hunting — KQL
kql 
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where ActionType == "RegistryValueSet"
| where RegistryKey has_any ("\\Winlogon", "\\Lsa", "\\Active Setup")
| where InitiatingProcessFileName !in~ ("msiexec.exe", "svchost.exe", "TiWorker.exe", "TrustedInstaller.exe")
| project Timestamp, DeviceName, RegistryKey, RegistryValueData, InitiatingProcessFileName
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13 (TargetObject="*\\Winlogon*" OR TargetObject="*\\Lsa\\*" OR TargetObject="*Active Setup*") NOT (Image="*\\msiexec.exe" OR Image="*\\svchost.exe" OR Image="*\\TiWorker.exe" OR Image="*\\TrustedInstaller.exe")
| table _time, host, TargetObject, Details, Image
| sort - _time

Hunt for new files created in the Startup folder — a common and simple persistence mechanism used by many malware families and threat actors.

Hunting — KQL
kql 
DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath has "Start Menu\\Programs\\Startup"
| where ActionType == "FileCreated"
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 TargetFilename="*Start Menu\\Programs\\Startup*"
| table _time, host, TargetFilename, Image, User
| sort - _time

Atomic Red Team Tests

Test 1 Add Registry Run Key for Persistence
windows

Creates a Run key entry in HKCU that would execute calc.exe at user logon. This is the most common autostart persistence mechanism used by malware.

Command

powershell 
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v df00tech-test /t REG_SZ /d "C:\Windows\System32\calc.exe" /f

Cleanup

powershell 
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v df00tech-test /f

Expected Telemetry

Sysmon Event ID 13: Registry value set on HKCU\Software\Microsoft\Windows\CurrentVersion\Run with value name 'df00tech-test'. DeviceRegistryEvents with ActionType 'RegistryValueSet'.

Expected Detection

Alert fires on Run key path match. Both KQL and SPL queries will capture this event with the full registry path and value data.

Test 2 Drop File in Startup Folder
windows

Places a benign batch script in the current user's Startup folder. The script will execute at next logon. Many malware families use this simple persistence method.

Command

powershell 
echo echo df00tech-test > "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\df00tech-test.bat"

Cleanup

powershell 
del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\df00tech-test.bat"

Expected Telemetry

Sysmon Event ID 11: FileCreate in the Startup directory. DeviceFileEvents with ActionType 'FileCreated' in the Startup folder path.

Expected Detection

Hunting query for Startup folder file creation will detect this. The file creation event captures the full path and initiating process.

Test 3 Modify Winlogon Shell Value
windows

Modifies the Winlogon Shell registry value to append a secondary executable. This technique is used by sophisticated malware like Gazer (Turla) and LockBit to achieve boot-level persistence.

Command

powershell 
reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, C:\Windows\System32\calc.exe" /f

Cleanup

powershell 
reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe" /f

Expected Telemetry

Sysmon Event ID 13: Registry value set on Winlogon\Shell. DeviceRegistryEvents with RegistryKey containing 'Winlogon' and RegistryValueName 'Shell'.

Expected Detection

Alert fires on Winlogon registry path match. The detection captures the modified Shell value showing the appended executable.

Related Detections

Tactic Hubs

TA0003 Persistence TA0004 Privilege Escalation

Sub-techniques (14)

Related Techniques

T1547.001 Registry Run Keys / Startup Folder T1547.004 Winlogon Helper DLL T1547.002 Authentication Package T1547.005 Security Support Provider T1547.014 Active Setup T1037 Boot or Logon Initialization Scripts T1543 Create or Modify System Process T1053.005 Scheduled Task T1574 Hijack Execution Flow T1112 Modify Registry

Same Tactic: Persistence

Popular Detections