Which SIEM platforms have a T1547 detection rule?

df00tech provides T1547 (Boot or Logon Autostart Execution) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the T1547 detection?

The T1547 detection is rated high severity with medium confidence.

What are common false positives for T1547?

Common false positives for T1547 include: Software installations that register legitimate autostart entries in Run keys; Windows Updates or Group Policy changes modifying Winlogon or Shell Folders registry keys; Print driver installations that add legitimate port monitors or print processors.

T1547 Splunk · SPL

Detect Boot or Logon Autostart Execution in Splunk

Q: What data sources are required to detect Boot or Logon Autostart Execution (T1547)?

Detecting Boot or Logon Autostart Execution requires the following data sources: Windows Registry: Windows Registry Key Modification, Windows Registry: Windows Registry Key Creation, Microsoft Defender for Endpoint.

Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon, including automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel. Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.

MITRE ATT&CK

Tactic: Persistence Privilege Escalation
Technique: T1547 Boot or Logon Autostart Execution
Canonical reference: https://attack.mitre.org/techniques/T1547/

SPL Detection Query

Splunk (SPL)

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=12 OR EventCode=13 OR EventCode=14)
  (TargetObject="*\\CurrentVersion\\Run*"
   OR TargetObject="*\\CurrentVersion\\Policies\\Explorer\\Run*"
   OR TargetObject="*\\CurrentVersion\\Winlogon*"
   OR TargetObject="*\\Active Setup\\Installed Components*"
   OR TargetObject="*\\Control\\Lsa\\*"
   OR TargetObject="*\\Control\\Print\\Monitors*"
   OR TargetObject="*\\Control\\Print\\Environments*"
   OR TargetObject="*\\Services\\W32Time\\TimeProviders*"
   OR TargetObject="*\\Explorer\\Shell Folders*"
   OR TargetObject="*\\Explorer\\User Shell Folders*")
| eval action=case(EventCode=12, "KeyCreated", EventCode=13, "ValueSet", EventCode=14, "KeyRenamed")
| table _time, host, action, TargetObject, Details, Image, User
| sort - _time

high severity medium confidence

Broad detection for modifications to Windows autostart registry locations using Sysmon registry events (Event IDs 12, 13, 14). Covers Run/RunOnce keys, Winlogon, Active Setup, LSA authentication and security packages, print monitors/processors, time providers, and shell folder redirections.

Data Sources

Windows Registry: Windows Registry Key ModificationWindows Registry: Windows Registry Key CreationSysmon Event ID 12/13/14

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives & Tuning

Software installations that register legitimate autostart entries in Run keys
Windows Updates or Group Policy changes modifying Winlogon or Shell Folders registry keys
Print driver installations that add legitimate port monitors or print processors
Enterprise IT tools (SCCM, Intune, GPO) deploying startup configurations

Download portable Sigma rule (.yml)

Other platforms for T1547

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Add Registry Run Key for Persistence
Expected signal: Sysmon Event ID 13: Registry value set on HKCU\Software\Microsoft\Windows\CurrentVersion\Run with value name 'df00tech-test'. DeviceRegistryEvents with ActionType 'RegistryValueSet'.
Test 2Drop File in Startup Folder
Expected signal: Sysmon Event ID 11: FileCreate in the Startup directory. DeviceFileEvents with ActionType 'FileCreated' in the Startup folder path.
Test 3Modify Winlogon Shell Value
Expected signal: Sysmon Event ID 13: Registry value set on Winlogon\Shell. DeviceRegistryEvents with RegistryKey containing 'Winlogon' and RegistryValueName 'Shell'.

Last updated: 2026-04-20 Research depth: deep

References (6)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1547 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Related Detections

Sub-techniques (14)

Related Techniques

T1547.001Registry Run Keys / Startup Folder T1547.004Winlogon Helper DLL T1547.002Authentication Package T1547.005Security Support Provider T1547.014Active Setup T1037Boot or Logon Initialization Scripts T1543Create or Modify System Process T1053.005Scheduled Task T1574Hijack Execution Flow T1112Modify Registry

Detect Boot or Logon Autostart Execution in Splunk

MITRE ATT&CK

SPL Detection Query

Data Sources

Required Sourcetypes

False Positives & Tuning

Other platforms for T1547

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Sub-techniques (14)

Related Techniques

Same Tactic: Persistence

Popular Detections

MITRE ATT&CK

SPL Detection Query

Data Sources

Required Sourcetypes

False Positives & Tuning

Other platforms for T1547

Testing Methodology

Unlock Pro Content

Related Detections

Sub-techniques (14)

Related Techniques

Same Tactic: Persistence

Popular Detections

Get new detections in your inbox