{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1547","id":"T1547","name":"Boot or Logon Autostart Execution","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1547","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"f4266e3737b31baf368f220f8ba742d54b4a6a634a1b3e4a758ba10b5cc45f65","description":"Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming) These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel.\n\nSince some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1547","external_id":"T1547"},{"source_name":"Cylance Reg Persistence Sept 2013","description":"Langendorf, S. (2013, September 24). Windows Registry Persistence, Part 2: The Run Keys and Search-Order. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20160214140250/http://blog.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order"},{"source_name":"MSDN Authentication Packages","description":"Microsoft. (n.d.). Authentication Packages. Retrieved March 1, 2017.","url":"https://msdn.microsoft.com/library/windows/desktop/aa374733.aspx"},{"source_name":"Microsoft Run Key","description":"Microsoft. (n.d.). Run and RunOnce Registry Keys. Retrieved September 12, 2024.","url":"https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys"},{"source_name":"Microsoft TimeProvider","description":"Microsoft. (n.d.). Time Provider. Retrieved March 26, 2018.","url":"https://msdn.microsoft.com/library/windows/desktop/ms725475.aspx"},{"source_name":"Linux Kernel Programming","description":"Pomerantz, O., Salzman, P.. (2003, April 4). The Linux Kernel Module Programming Guide. Retrieved April 6, 2018.","url":"https://www.tldp.org/LDP/lkmpg/2.4/lkmpg.pdf"},{"source_name":"TechNet Autoruns","description":"Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.","url":"https://technet.microsoft.com/en-us/sysinternals/bb963902"}],"platforms":["Linux","macOS","Windows","Network Devices"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1547.001","id":"T1547.001","name":"Registry Run Keys / Startup Folder","page":"techniques/enterprise/T1547.001/"},{"key":"enterprise/T1547.002","id":"T1547.002","name":"Authentication Package","page":"techniques/enterprise/T1547.002/"},{"key":"enterprise/T1547.003","id":"T1547.003","name":"Time Providers","page":"techniques/enterprise/T1547.003/"},{"key":"enterprise/T1547.004","id":"T1547.004","name":"Winlogon Helper DLL","page":"techniques/enterprise/T1547.004/"},{"key":"enterprise/T1547.005","id":"T1547.005","name":"Security Support Provider","page":"techniques/enterprise/T1547.005/"},{"key":"enterprise/T1547.006","id":"T1547.006","name":"Kernel Modules and Extensions","page":"techniques/enterprise/T1547.006/"},{"key":"enterprise/T1547.007","id":"T1547.007","name":"Re-opened Applications","page":"techniques/enterprise/T1547.007/"},{"key":"enterprise/T1547.008","id":"T1547.008","name":"LSASS Driver","page":"techniques/enterprise/T1547.008/"},{"key":"enterprise/T1547.009","id":"T1547.009","name":"Shortcut Modification","page":"techniques/enterprise/T1547.009/"},{"key":"enterprise/T1547.010","id":"T1547.010","name":"Port Monitors","page":"techniques/enterprise/T1547.010/"},{"key":"enterprise/T1547.012","id":"T1547.012","name":"Print Processors","page":"techniques/enterprise/T1547.012/"},{"key":"enterprise/T1547.013","id":"T1547.013","name":"XDG Autostart Entries","page":"techniques/enterprise/T1547.013/"},{"key":"enterprise/T1547.014","id":"T1547.014","name":"Active Setup","page":"techniques/enterprise/T1547.014/"},{"key":"enterprise/T1547.015","id":"T1547.015","name":"Login Items","page":"techniques/enterprise/T1547.015/"}],"telemetry":[{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0061","name":"File Modification","page":"telemetry/DC0061/","kind":"attack_component","category":"Endpoint activity","description":"Changes to file data or attributes.","collection_focus":"Use file-integrity monitoring or scoped OS file-write auditing for general changes. Sysmon 2 records creation-time changes; it is not a general file-write event.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["path","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0041","name":"Service Metadata","page":"telemetry/DC0041/","kind":"attack_component","category":"Host state and inventory","description":"Service configuration and current state at observation time.","collection_focus":"Inventory service name, executable, startup mode, owner and status using supported OS APIs; compare successive snapshots.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["service","executable","start_mode","state"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0041","collector":"illustrative-lab-collector","observation":{"service":"LabService","executable":"C:\\Lab\\service.exe","start_mode":"manual","state":"stopped"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0063","name":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component","category":"Endpoint activity","description":"Registry value changes or registry object renames.","collection_focus":"Use RegistryEvent 13 for value-set and 14 for rename; compare against intended policy and keep original type/value where available.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence."],"configuration_example":null,"required_fields":["registry_path","event_type","value_type","value"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1547","id":"T1547","name":"Boot or Logon Autostart Execution","domain":"enterprise","platforms":["Linux","macOS","Windows","Network Devices"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"source_url":"https://attack.mitre.org/techniques/T1547","technique_page":"techniques/enterprise/T1547/","page":"detections/enterprise/T1547/","status":"rule_source_available","counts":{"sigma":7,"atlas_basic":0,"atlas_anomaly":1,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[{"id":"123e4e6d-b123-48f8-b261-7214938acaf0","title":"Startup/Logon Script Added to Group Policy Object","status":"test","level":"medium","logsource":{"product":"windows","service":"security","definition":"The advanced audit policy setting \"Object Access > Audit Detailed File Share\" must be configured for Success/Failure"},"data_path":"data/detection-rules/123e4e6d-b123-48f8-b261-7214938acaf0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_susp_group_policy_startup_script_added_to_gpo.yml","author":"Elastic, Josh Nickels, Marius Rothenbücher","kind":"sigma"},{"id":"a6976974-ea6f-4e97-818e-ea08625c52cb","title":"Potential RipZip Attack on Startup Folder","status":"test","level":"high","logsource":{"category":"file_event","product":"windows"},"data_path":"data/detection-rules/a6976974-ea6f-4e97-818e-ea08625c52cb.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_ripzip_attack.yml","author":"Greg (rule)","kind":"sigma"},{"id":"a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1","title":"Suspicious Driver Install by pnputil.exe","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_susp_driver_installed_by_pnputil.yml","author":"Hai Vaknin @LuxNoBulIshit, Avihay eldad  @aloneliassaf, Austin Songer @austinsonger","kind":"sigma"},{"id":"f14e169e-9978-4c69-acb3-1cff8200bc36","title":"Suspicious GrpConv Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f14e169e-9978-4c69-acb3-1cff8200bc36.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_susp_grpconv.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"277efb8f-60be-4f10-b4d3-037802f37167","title":"Registry Persistence Mechanisms in Recycle Bin","status":"test","level":"high","logsource":{"category":"registry_event","product":"windows"},"data_path":"data/detection-rules/277efb8f-60be-4f10-b4d3-037802f37167.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_event/registry_event_persistence_recycle_bin.yml","author":"frack113","kind":"sigma"},{"id":"b98968aa-dbc0-4a9c-ac35-108363cbf8d5","title":"WINEKEY Registry Modification","status":"test","level":"high","logsource":{"category":"registry_event","product":"windows"},"data_path":"data/detection-rules/b98968aa-dbc0-4a9c-ac35-108363cbf8d5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_event/registry_event_runkey_winekey.yml","author":"omkar72","kind":"sigma"},{"id":"9577edbb-851f-4243-8c91-1d5b50c1a39b","title":"Atbroker Registry Change","status":"test","level":"medium","logsource":{"category":"registry_event","product":"windows"},"data_path":"data/detection-rules/9577edbb-851f-4243-8c91-1d5b50c1a39b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_event/registry_event_susp_atbroker_change.yml","author":"Mateusz Wydra, oscd.community","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[{"id":"atlas-anomaly-t1547-1","technique_id":"T1547","title":"Startup or logon configuration changed to launch code — T1547 Boot or Logon Autostart Execution","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#autostart-change","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":56,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L56","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"94c15e07598c66c860cf97b5610637516827dfb40f2db8f626b08e882fbc28da","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"host and autostart location.","expected_behavior":"stable set of startup entries and executable targets.","deviation":"first-seen target, unusual modification actor, or abrupt state transition.","anomaly_types":[{"title":"Novel-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#85-novel-category-anomaly"},{"title":"Self-Baseline Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#7-self-baseline-anomaly"},{"title":"Change-Point Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#25-change-point-anomaly"}],"log_sources":[{"title":"Registry and Configuration-Store Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#15-registry-and-configuration-store-logs"},{"title":"File-System Activity Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#13-file-system-activity-logs"}],"context_references":[{"title":"Volt Typhoon joint advisory — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/fbi-aa24-038a-volt-typhoon.pdf"},{"title":"original source","url":"https://www.fbi.gov/file-repository/cyber-alerts/prc-state-sponsored-actors-compromise-and-maintain-persistent-access-to-u-s-critical-infrastructure.pdf"}]}],"anomaly_types":[{"title":"Change-Point Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#25-change-point-anomaly"},{"title":"Novel-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#85-novel-category-anomaly"},{"title":"Self-Baseline Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#7-self-baseline-anomaly"}],"strategies":[{"id":"DET0274","name":"Boot or Logon Autostart Execution Detection Strategy","url":"https://attack.mitre.org/detectionstrategies/DET0274","stix_id":"x-mitre-detection-strategy--a9796458-df5d-467f-b037-acad6c261f25","relationship_id":"relationship--5a1625a0-a01c-41ca-8601-89faa103e31d","description":"","analytics":[{"id":"AN0764","name":"Analytic 0764","guidance":"Correlation of registry key modification for Run/RunOnce with abnormal parent-child process relationships and outlier execution at user logon or system startup","url":"https://attack.mitre.org/detectionstrategies/DET0274#AN0764","platforms":["Windows"],"tuning":[{"field":"ParentProcessName","description":"Customize based on expected parent-child process lineage for autostarts"},{"field":"StartupRegistryPath","description":"May vary based on organization policy or installed software"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN0764","source_url":"https://attack.mitre.org/detectionstrategies/DET0274#AN0764","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0063","component":"Windows Registry Key Modification","name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","platforms":["Windows"],"analytic_id":"AN0764","source_url":"https://attack.mitre.org/detectionstrategies/DET0274#AN0764","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0063/"}]},{"id":"AN0765","name":"Analytic 0765","guidance":"Correlates creation/modification of systemd service files or /etc/init.d scripts with outlier process behavior during boot","url":"https://attack.mitre.org/detectionstrategies/DET0274#AN0765","platforms":["Linux"],"tuning":[{"field":"FilePath","description":"Organizations may use different init systems or custom startup paths"},{"field":"UserContext","description":"Autostart scripts should run as root or system users; deviations are suspect"}],"log_sources":[{"component_id":"DC0039","component":"File Creation","name":"auditd:SYSCALL","channel":"creat","platforms":["Linux"],"analytic_id":"AN0765","source_url":"https://attack.mitre.org/detectionstrategies/DET0274#AN0765","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0061","component":"File Modification","name":"auditd:SYSCALL","channel":"write","platforms":["Linux"],"analytic_id":"AN0765","source_url":"https://attack.mitre.org/detectionstrategies/DET0274#AN0765","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"},{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"Execution of binaries located in /etc/init.d/ or systemd service paths","platforms":["Linux"],"analytic_id":"AN0765","source_url":"https://attack.mitre.org/detectionstrategies/DET0274#AN0765","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0766","name":"Analytic 0766","guidance":"Observes creation or modification of LaunchAgent/LaunchDaemon property list files combined with anomalous plist payload execution after user logon","url":"https://attack.mitre.org/detectionstrategies/DET0274#AN0766","platforms":["macOS"],"tuning":[{"field":"PlistKey","description":"Organizations may use specific keys or additional payload parameters"},{"field":"TimeWindow","description":"Tunable based on expected delay between plist write and execution"}],"log_sources":[{"component_id":"DC0041","component":"Service Metadata","name":"macos:unifiedlog","channel":"Observed loading of new LaunchAgent or LaunchDaemon plist","platforms":["macOS"],"analytic_id":"AN0766","source_url":"https://attack.mitre.org/detectionstrategies/DET0274#AN0766","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0041/"},{"component_id":"DC0061","component":"File Modification","name":"macos:unifiedlog","channel":"write","platforms":["macOS"],"analytic_id":"AN0766","source_url":"https://attack.mitre.org/detectionstrategies/DET0274#AN0766","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"},{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"Execution of binary listed in newly modified LaunchAgent plist","platforms":["macOS"],"analytic_id":"AN0766","source_url":"https://attack.mitre.org/detectionstrategies/DET0274#AN0766","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]}]}],"telemetry_references":[{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0061","name":"File Modification","tag":"File Modification","page":"telemetry/DC0061/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0041","name":"Service Metadata","tag":"Service Metadata","page":"telemetry/DC0041/","kind":"attack_component"},{"id":"DC0063","name":"Windows Registry Key Modification","tag":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0083","name":"Misdat","url":"https://attack.mitre.org/software/S0083","kind":"malware","description":"[Misdat](https://attack.mitre.org/software/S0083) has created registry keys for persistence, including `HKCU\\Software\\dnimtsoleht\\StubPath`, `HKCU\\Software\\snimtsOleht\\StubPath`, `HKCU\\Software\\Backtsaleht\\StubPath`, `HKLM\\SOFTWARE\\Microsoft\\Active Setup\\Installed. Components\\{3bf41072-b2b1-21c8-b5c1-bd56d32fbda7}`, and `HKLM\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components\\{3ef41072-a2f1-21c8-c5c1-70c2c3bc7905}`.(Citation: Cylance Dust Storm) ","relationship_id":"relationship--9c63a942-eb05-401b-a49a-39dc05ef1dd9","references":[{"source_name":"Cylance Dust Storm","description":"Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}]},{"id":"S0084","name":"Mis-Type","url":"https://attack.mitre.org/software/S0084","kind":"malware","description":"[Mis-Type](https://attack.mitre.org/software/S0084) has created registry keys for persistence, including `HKCU\\Software\\bkfouerioyou`, `HKLM\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components\\{6afa8072-b2b1-31a8-b5c1-{Unique Identifier}`, and `HKLM\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components\\{3BF41072-B2B1-31A8-B5C1-{Unique Identifier}`.(Citation: Cylance Dust Storm)","relationship_id":"relationship--323eed81-9e09-44fb-9dea-bad6aae88e7f","references":[{"source_name":"Cylance Dust Storm","description":"Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}]},{"id":"S0567","name":"Dtrack","url":"https://attack.mitre.org/software/S0567","kind":"malware","description":"[Dtrack](https://attack.mitre.org/software/S0567)’s RAT makes a persistent target file with auto execution on the host start.(Citation: Securelist Dtrack)","relationship_id":"relationship--2e9d5640-a88d-4812-b2dc-a94621a95959","references":[{"source_name":"Securelist Dtrack","description":"Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.","url":"https://securelist.com/my-name-is-dtrack/93338/"}]},{"id":"S0651","name":"BoxCaon","url":"https://attack.mitre.org/software/S0651","kind":"malware","description":"[BoxCaon](https://attack.mitre.org/software/S0651) established persistence by setting the <code>HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\load</code> registry key to point to its executable.(Citation: Checkpoint IndigoZebra July 2021)","relationship_id":"relationship--99070a6a-e0c3-455b-8e4b-9239206e56ec","references":[{"source_name":"Checkpoint IndigoZebra July 2021","description":"CheckPoint Research. (2021, July 1). IndigoZebra APT continues to attack Central Asia with evolving tools. Retrieved September 24, 2021.","url":"https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"}]},{"id":"S0653","name":"xCaon","url":"https://attack.mitre.org/software/S0653","kind":"malware","description":"[xCaon](https://attack.mitre.org/software/S0653) has added persistence via the Registry key <code>HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\load</code> which causes the malware to run each time any user logs in.(Citation: Checkpoint IndigoZebra July 2021)","relationship_id":"relationship--1858731f-2e82-4704-acba-b8de57dcfc4f","references":[{"source_name":"Checkpoint IndigoZebra July 2021","description":"CheckPoint Research. (2021, July 1). IndigoZebra APT continues to attack Central Asia with evolving tools. Retrieved September 24, 2021.","url":"https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"}]}],"actors":[{"id":"G1044","name":"APT42","url":"https://attack.mitre.org/groups/G1044","kind":"intrusion-set","description":"[APT42](https://attack.mitre.org/groups/G1044) has modified the Registry to maintain persistence.(Citation: Mandiant APT42-charms) ","relationship_id":"relationship--eb537310-fa06-4bde-a074-ed3234ec1a27","references":[{"source_name":"Mandiant APT42-charms","description":"Mandiant. (n.d.). APT42: Crooked Charms, Cons and Compromises. Retrieved October 9, 2024.","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}]}],"mitigations":[],"candidates":[{"id":"5cb0b071-8a5a-412f-839d-116beb2ed9f7","name":"Driver Installation Using pnputil.exe","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547/T1547.yaml","description":"pnputil.exe is a native command-line utility in Windows to install drivers, this can be abused by to install malicious drivers. Ref: https://lolbas-project.github.io/lolbas/Binaries/Pnputil/\n","inputs":{"driver_path":{"description":"Enter the driver file path to install (Default is used built-in windows driver - acpipmi.inf)","type":"path","default":"C:\\Windows\\INF\\acpipmi.inf"}},"dependencies":[],"source_definition_sha256":"a78cae9d03dabf6fca14add9a14ff34b9fde0ea4b5806e1578f3d90a9e81c53c"},{"id":"cb01b3da-b0e7-4e24-bf6d-de5223526785","name":"Add a driver","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547/T1547.yaml","description":"Install a driver via pnputil.exe lolbin\n","inputs":{"driver_inf":{"description":"A built-in, already installed windows driver inf","type":"path","default":"C:\\Windows\\INF\\usbstor.inf"}},"dependencies":[],"source_definition_sha256":"169449112cf85b141b2bd7ce8bac42dec829184488c204298c7eba9fb27c9d5e"},{"id":"fdd45306-74f6-4ade-9a97-0a4895961228","name":"Leverage Virtual Channels to execute custom DLL during successful RDP session","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1547/T1547.yaml","description":"Virtual Channels can be leveraged to alter RDP behavior using dedicated Addins.The mechanism is implemented using DLLs which can be executed during RDP session automatically. \nThe DLLs are loaded in the host system only after successful connection is established with the remote system.\nOnce the test is run, amsi.dll will be loaded on the host system during successful RDP session.\nBlog :https://learn.microsoft.com/en-us/windows/win32/termserv/terminal-services-virtual-channels?redirectedfrom=MSDN\n","inputs":{"Subkey_Added":{"description":"New Sub key added in the registry path","type":"String","default":"Malware"},"dll_inf":{"description":"custom DLL to be executed","type":"Path","default":"C:\\Windows\\System32\\amsi.dll"}},"dependencies":[],"source_definition_sha256":"8460e553a35fbbdf699cb362fdc3a2e3574538ff32110f33c96b27b8e9d055be"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1547":"/ttp-simulation/techniques/enterprise/T1547/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1547","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0041","collector":"illustrative-lab-collector","observation":{"service":"LabService","executable":"C:\\Lab\\service.exe","start_mode":"manual","state":"stopped"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}}]}}