Boot or Logon Autostart Execution

What is Boot or Logon Autostart Execution?

“Boot or Logon Autostart Execution is documented as technique T1547 in MITRE ATT&CK® v19.1 under the Persistence tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Boot or Logon Autostart Execution activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Watch Sysmon Event ID 13 (RegistryEvent, Value Set) and Event ID 12 (key create and delete) where TargetObject contains \Software\Microsoft\Windows\CurrentVersion\Run or \RunOnce, the keys the SigmaHQ ASEP rule selects. Match on the path after the hive, since Sysmon abbreviates root key names (HKEY_LOCAL_MACHINE to HKLM, HKEY_USERS to HKU). Then read Image and Details: a command line pointing into AppData or Temp, written by powershell.exe or wscript.exe, is the alert. RunOnce values are deleted before their command runs, so by the time you look the key may be empty and only the Sysmon record shows what ran.

2. 2

   Sysmon Event ID 11 (FileCreate) is the event Microsoft points to for autostart locations like the Startup folder. Cover both paths: C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup and C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp. A .lnk, .js, .vbs or .exe dropped there by an Office application or a script host is worth escalating.

3. 3

   Winlogon persistence sits under HKLM and HKCU \Software\Microsoft\Windows NT\CurrentVersion\Winlogon: Userinit points to userinit.exe and Shell to explorer.exe, and anything appended after a comma ("explorer.exe, <payload>") is a finding. Without Sysmon, Security event 4657 gives you Object Name, Object Value Name, Old Value, New Value and Process Name, but only when Audit Registry is on and the key's SACL audits Set Value.

4. 4

   Monitor service creation and modification events, focusing on services created outside of standard software installation processes or services pointing to executables in non-standard locations.

5. 5

   Implement file integrity monitoring on autostart script locations on Linux systems including /etc/init.d/, systemd unit directories, and user-specific .bashrc and .profile files that execute on login.

6. 6

   For response, run autorunsc -a * -c -h -s -m * on the host: every autostart category, CSV output, file hashes, signature checks, Microsoft entries hidden, all user profiles. Diff the output against the same command on a clean machine of the same build; unsigned entries in user-writable paths go to the top of the list.

Example Alerts

These realistic alert examples show what Boot or Logon Autostart Execution looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Boot or Logon Autostart Execution?

Detection centers on XDR, SIEM telemetry for the persistence phase of the attack. Watch Sysmon Event ID 13 (RegistryEvent, Value Set) and Event ID 12 (key create and delete) where TargetObject contains \Software\Microsoft\Windows\CurrentVersion\Run or \RunOnce, the keys the SigmaHQ ASEP rule selects. Match on the path after the hive, since Sysmon abbreviates root key names (HKEY_LOCAL_MACHINE to HKLM, HKEY_USERS to HKU). Then read Image and Details: a command line pointing into AppData or Temp, written by powershell.exe or wscript.exe, is the alert. RunOnce values are deleted before their command runs, so by the time you look the key may be empty and only the Sysmon record shows what ran. Sysmon Event ID 11 (FileCreate) is the event Microsoft points to for autostart locations like the Startup folder. Cover both paths: C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup and C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp. A .lnk, .js, .vbs or .exe dropped there by an Office application or a script host is worth escalating.

What does a Boot or Logon Autostart Execution alert look like?

A representative XDR detection is "Malicious Registry Run Key Added" (high severity): Registry modification detected adding a new value to HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The entry points to a file in %AppData%\Microsoft\Windows named svchost32.exe, which is not a legitimate Windows system file. The file was created 3 minutes prior by a PowerShell process with encoded command line arguments.

Which tools detect Boot or Logon Autostart Execution, and how can I practice?

Boot or Logon Autostart Execution (T1547) is best surfaced with XDR, SIEM telemetry, which exposes the persistence signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.