T1547Persistencemedium difficulty

Boot or Logon Autostart Execution

This persistence class abuses the built-in startup plumbing of the operating system so a payload relaunches at every boot or logon. On Windows that means Run and RunOnce registry keys, Startup folders, auto-start services, and Winlogon hooks; on Linux, init scripts, systemd units, and shell profile files. The key detection question is who made the change, since legitimate apps touch these locations during installation with elevation, while malware writes entries pointing to user-writable or oddly named binaries.

Practice detecting Boot or Logon Autostart Execution on realistic XDR, SIEM alerts in SOCSimulator Operations.

XDRSIEM

View T1547 on MITRE ATT&CK®

What is Boot or Logon Autostart Execution?

“Boot or Logon Autostart Execution is documented as technique T1547 in MITRE ATT&CK® v19.1 under the Persistence tactic. Detection requires visibility into XDR, SIEM telemetry.”
— MITRE ATT&CK® v19.1 (2026)

Detection Strategies

The following detection strategies help SOC analysts identify Boot or Logon Autostart Execution activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1
Monitor Windows Registry modifications to HKLM and HKCU Run and RunOnce keys, alerting on new entries pointing to executables in user-writable locations or using obfuscated command line arguments.
2
Track file creation events in Windows Startup folder locations for all users, including AllUsers and per-user startup folders, which are commonly used for persistence by malware that does not require administrative privileges.
3
Monitor service creation and modification events, focusing on services created outside of standard software installation processes or services pointing to executables in non-standard locations.
4
Implement file integrity monitoring on autostart script locations on Linux systems including /etc/init.d/, systemd unit directories, and user-specific .bashrc and .profile files that execute on login.
5
Correlate autostart location modifications with the process that made the change and the user context, as legitimate applications typically modify these locations only during installation with elevated privileges.

Example Alerts

These realistic alert examples show what Boot or Logon Autostart Execution looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

HighXDR

Malicious Registry Run Key Added

Registry modification detected adding a new value to HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The entry points to a file in %AppData%\Roaming\Microsoft\Windows named svchost32.exe, which is not a legitimate Windows system file. The file was created 3 minutes prior by a PowerShell process with encoded command line arguments.

MediumXDR

Suspicious File Added to Startup Folder

File creation detected in C:\Users\Public\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup. The file is a JavaScript file disguised with a PDF icon. Upon execution it connects to a remote server and downloads additional payloads. The file was created by an Office process following macro execution in a received document.

CriticalSIEM

New Malicious Service Registered

New Windows service registered with display name "Windows Security Health Monitor" using sc.exe. The service executable resides in C:\ProgramData\Microsoft\Temp and is not digitally signed. The service is configured for automatic startup and runs as SYSTEM. Hash of the executable matches a known remote access trojan in threat intelligence databases.

Frequently Asked Questions

How do SOC analysts detect Boot or Logon Autostart Execution?: Detection centers on XDR, SIEM telemetry for the persistence phase of the attack. Monitor Windows Registry modifications to HKLM and HKCU Run and RunOnce keys, alerting on new entries pointing to executables in user-writable locations or using obfuscated command line arguments. Track file creation events in Windows Startup folder locations for all users, including AllUsers and per-user startup folders, which are commonly used for persistence by malware that does not require administrative privileges.
What does a Boot or Logon Autostart Execution alert look like?: A representative XDR detection is "Malicious Registry Run Key Added" (high severity): Registry modification detected adding a new value to HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The entry points to a file in %AppData%\Roaming\Microsoft\Windows named svchost32.exe, which is not a legitimate Windows system file. The file was created 3 minutes prior by a PowerShell process with encoded command line arguments.
Which tools detect Boot or Logon Autostart Execution, and how can I practice?: Boot or Logon Autostart Execution (T1547) is best surfaced with XDR, SIEM telemetry, which exposes the persistence signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.

Practice Boot or Logon Autostart Execution in a Free Room

Investigate Boot or Logon Autostart Execution on realistic SIEM, XDR, and firewall consoles, free.

ClickFix: The Fake CAPTCHA Trap

The ClickFix social engineering technique uses dialogue boxes containing fake error messages to trick victims into copying, pasting, and running malicious content. In this scenario, a user was targeted with a 'Verify You Are Human' CAPTCHA check that led to a significant endpoint compromise. You will analyze the 'paste-and-run' execution chain, investigate PowerShell activity initiated via the Windows Run dialog, and identify the deployment of an information stealer.

20m·255 tasks

View Operation

Purchase Order, Poisoned

A sales coordinator opened a malspam 'purchase order' and a finance workstation went quiet, then started talking to the internet. Follow the chain from a sender-spoofed email through an Equation Editor exploit, a rundll32 loader, Run-key persistence, and a hollowed system process to the FormBook stealer's HTTP command-and-control.

30m·256 tasks

View Operation

Remcos RAT: Malicious Invoice Attachment

An accounts-payable employee at Harwell Logistics opens what looks like an overdue supplier invoice, and minutes later her workstation is holding a persistent outbound session to an address outside the company on a port nothing else uses. Walk the mail gateway records, the endpoint file artifacts and the process tree in order, pulling one indicator out of each surface until the delivery, the loader, the execution chain and the implant are all named, then close the case with an ATT&CK label.

25m·256 tasks

View Operation

Glossary

Boot or Logon Autostart Execution

What is Boot or Logon Autostart Execution?

Detection Strategies