T1547.001 Registry Run Keys / Startup Folder — Detection Rules

Source-backed rule directory

• File Creation In Suspicious Directory By Msdt.EXE · test · high · {"category":"file_event","product":"windows"}
• Potential Startup Shortcut Persistence Via PowerShell.EXE · test · high · {"product":"windows","category":"file_event"}
• Startup Folder File Write · test · medium · {"product":"windows","category":"file_event"}
• Suspicious Startup Folder Persistence · test · high · {"product":"windows","category":"file_event"}
• WinRAR Creating Files in Startup Locations · experimental · high · {"category":"file_event","product":"windows"}
• Suspicious Autorun Registry Modified via WMI · experimental · high · {"category":"process_creation","product":"windows"}
• Potential Persistence Attempt Via Run Keys Using Reg.EXE · test · medium · {"category":"process_creation","product":"windows"}
• Direct Autorun Keys Modification · test · medium · {"category":"process_creation","product":"windows"}
• Potential Suspicious Activity Using SeCEdit · test · medium · {"category":"process_creation","product":"windows"}
• User Shell Folders Registry Modification via CommandLine · experimental · high · {"category":"process_creation","product":"windows"}
• Narrator's Feedback-Hub Persistence · test · high · {"category":"registry_event","product":"windows"}
• Suspicious Run Key from Download · test · high · {"category":"registry_event","product":"windows"}
• Classes Autorun Keys Modification · test · medium · {"category":"registry_set","product":"windows"}
• Common Autorun Keys Modification · test · medium · {"category":"registry_set","product":"windows"}
• CurrentControlSet Autorun Keys Modification · test · medium · {"category":"registry_set","product":"windows"}
• CurrentVersion Autorun Keys Modification · test · medium · {"category":"registry_set","product":"windows"}
• CurrentVersion NT Autorun Keys Modification · test · medium · {"category":"registry_set","product":"windows"}
• Internet Explorer Autorun Keys Modification · test · medium · {"category":"registry_set","product":"windows"}
• Office Autorun Keys Modification · test · medium · {"category":"registry_set","product":"windows"}
• Session Manager Autorun Keys Modification · test · medium · {"category":"registry_set","product":"windows"}
• System Scripts Autorun Keys Modification · test · medium · {"category":"registry_set","product":"windows"}
• WinSock2 Autorun Keys Modification · test · medium · {"category":"registry_set","product":"windows"}
• Wow6432Node CurrentVersion Autorun Keys Modification · test · medium · {"category":"registry_set","product":"windows"}
• Wow6432Node Classes Autorun Keys Modification · test · medium · {"category":"registry_set","product":"windows"}
• Wow6432Node Windows NT CurrentVersion Autorun Keys Modification · test · medium · {"category":"registry_set","product":"windows"}
• Windows Event Log Access Tampering Via Registry · experimental · high · {"category":"registry_set","product":"windows"}
• Suspicious PowerShell In Registry Run Keys · test · medium · {"category":"registry_set","product":"windows"}
• Registry Persistence via Explorer Run Key · test · high · {"category":"registry_set","product":"windows"}
• New RUN Key Pointing to Suspicious Folder · experimental · high · {"category":"registry_set","product":"windows"}
• Modify User Shell Folders Startup Value · test · high · {"product":"windows","category":"registry_set"}
• VBScript Payload Stored in Registry · test · high · {"category":"registry_set","product":"windows"}

Atlas deterministic concepts

T1547.001 Registry Run Keys / Startup Folder

MATCH(registry_or_startup_path IN autostart_locations) AND executable NOT_IN approved_autostart_programs -> ALERT

• Registry and Configuration-Store Logs
• File-System Activity Logs
• Atlas source section

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0365 Detect Registry and Startup Folder Persistence (Windows)

AN1032 Analytic 1032

Correlation of Registry key creation/modification events under known Run/Startup keys with new or unusual binary paths or script-based payloads. Multi-event detection includes registry modification followed by process execution from non-standard directories or abnormal parent-child process relationships.