T1547 Boot or Logon Autostart Execution — Detection Rules

Detection workspace for T1547 Boot or Logon Autostart Execution: 7 Sigma sources, 0 Atlas concepts and 1 anomaly models. No live detection validation.

Source-backed rule directory

Startup/Logon Script Added to Group Policy Object · test · medium · {"product":"windows","service":"security","definition":"The advanced audit policy setting \"Object Access > Audit Detailed File Share\" must be configured for Success/Failure"}
Potential RipZip Attack on Startup Folder · test · high · {"category":"file_event","product":"windows"}
Suspicious Driver Install by pnputil.exe · test · medium · {"category":"process_creation","product":"windows"}
Suspicious GrpConv Execution · test · high · {"category":"process_creation","product":"windows"}
Registry Persistence Mechanisms in Recycle Bin · test · high · {"category":"registry_event","product":"windows"}
WINEKEY Registry Modification · test · high · {"category":"registry_event","product":"windows"}
Atbroker Registry Change · test · medium · {"category":"registry_event","product":"windows"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

Startup or logon configuration changed to launch code — T1547 Boot or Logon Autostart Execution

Comparison unit: host and autostart location.

Expected behavior: stable set of startup entries and executable targets.

Deviation: first-seen target, unusual modification actor, or abrupt state transition.

ATT&CK analytic guidance

DET0274 Boot or Logon Autostart Execution Detection Strategy

AN0764 Analytic 0764

Correlation of registry key modification for Run/RunOnce with abnormal parent-child process relationships and outlier execution at user logon or system startup

AN0765 Analytic 0765

Correlates creation/modification of systemd service files or /etc/init.d scripts with outlier process behavior during boot

AN0766 Analytic 0766

Observes creation or modification of LaunchAgent/LaunchDaemon property list files combined with anomalous plist payload execution after user logon

Connected ecosystem references

Linked tags

rule_source_available Change-Point Anomaly Novel-Category Anomaly Self-Baseline Anomaly

Simulation, tools and telemetry

T1547 simulation workspace

No reviewed association in this snapshot.

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

APT42 · G1044

Existing anomaly research

Original publication snapshot · Anomaly Detection Atlas

Connected anomaly research

Curated research views reached through an exact source technique, a catalog model, or a reviewed collection reference. These are navigation associations, not claims of detector effectiveness or sensor equivalence.

State-Change

Telemetry contracts · Maintained query examples · Validation and blind spots

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.