Wiki › Techniques, Tactics & Procedures (TTPs) › Persistence › Boot or Logon Autostart Execution

Boot or Logon Autostart Execution

3 min read

Jump to:

Overview

Boot or Logon Autostart Execution is a technique where adversaries configure malicious code or scripts to automatically execute during system boot or user logon. This method is commonly employed to establish persistence, maintain execution capabilities, or escalate privileges within a compromised environment. By leveraging system mechanisms that trigger execution early in the system lifecycle, attackers ensure their code runs with minimal user interaction and often with elevated privileges.

Attack Objective

Establish persistent access or maintain execution control on a target system
Supports multiple stages including Initial Access, Persistence, Privilege Escalation, and Execution
Advances attacker position by enabling automatic code execution upon system start or user logon, facilitating stealthy and continuous operation

How the Technique Works

This technique exploits legitimate operating system features that allow programs or scripts to run automatically during system startup or user authentication. Adversaries modify or add entries to autostart locations such as registry keys, startup folders, scheduled tasks, or system services. When the system boots or a user logs in, the configured payload executes without requiring explicit user action, enabling attackers to maintain footholds or escalate privileges.

Common Methods & Variations

Modifying registry run keys (e.g., HKLMSoftwareMicrosoftWindowsCurrentVersionRun)
Adding executables or scripts to startup folders or scheduled tasks
Creating or altering system services to launch malicious code at boot
Using Group Policy or login scripts in enterprise environments
Variants exist across on-premises endpoints, cloud virtual machines, and identity systems leveraging login scripts or policies
Use of living-off-the-land binaries (LOLBins) and trusted system utilities versus custom malware payloads

Indicators of Compromise (IOCs)

Unexpected or suspicious entries in autostart registry keys or startup folders
Creation or modification of scheduled tasks and services outside normal change windows
Execution logs showing processes launched at boot or logon times
Unusual command-line arguments or parent-child process relationships involving system utilities
Authentication logs indicating execution of login scripts or Group Policy changes

Detection Strategies

Monitoring registry and file system changes related to autostart locations
Behavioral detection focusing on anomalous process creation at boot or logon
Correlation of scheduled task creation/modification events with user activity
Analysis of process trees and command-line parameters for suspicious patterns
Utilizing endpoint detection and response (EDR) telemetry and system event logs

Mitigation & Prevention

Implement least privilege principles to restrict modification of autostart locations
Enforce application whitelisting and code signing policies
Harden system configurations by limiting use of legacy autostart mechanisms
Regularly audit and monitor autostart entries and scheduled tasks
Use Group Policy and endpoint management tools to control startup scripts and services
Educate users and administrators on risks associated with unauthorized startup modifications

Response Considerations

Immediately isolate affected systems to prevent further execution
Investigate autostart entries and associated payloads to determine scope and persistence mechanisms
Identify and remediate any related privilege escalation or lateral movement activities
Remove unauthorized autostart configurations and validate system integrity
Apply patches and hardening measures to prevent recurrence
Review and enhance monitoring to detect future attempts

Related Techniques

Scheduled Task/Job (Persistence and Execution)
Service Registry Permissions Weakness (Privilege Escalation)
Valid Accounts (Initial Access and Persistence)
Process Injection (Defense Evasion and Execution)
Credential Dumping (Credential Access)

Mapping & References

MITRE ATT&CK T1547 – Boot or Logon Autostart Execution
MITRE ATT&CK T1547.001 – Registry Run Keys / Startup Folder
MITRE ATT&CK T1547.002 – Authentication Package
MITRE ATT&CK T1547.003 – Time Providers
Public advisories and incident reports from cybersecurity vendors and CERTs detailing autostart exploitation cases

Tags: Autostart Command and Control Defense Evasion Execution Exfiltration Initial Access lateral movement persistence privilege escalation Registry Scheduled Tasks System Services