Wiki › Techniques, Tactics & Procedures (TTPs) › Persistence › Registry Run Keys and Startup Folder Persistence

Registry Run Keys and Startup Folder Persistence

2 min read

Jump to:

Overview

Registry Run Keys and Startup Folder Persistence are common techniques used by adversaries to maintain access and ensure execution of malicious code upon system startup or user logon. These methods play a critical role in the persistence phase of the attack lifecycle, allowing attackers to regain control after system reboots or user sessions.

Attack Objective

Maintain persistent execution of malicious payloads to ensure continued access and control
Supports the Persistence stage primarily, with implications for Execution and Defense Evasion
Enables adversaries to survive system restarts and user logoffs, facilitating long-term footholds

How the Technique Works

Adversaries modify specific Windows Registry keys or place executable files or shortcuts in designated startup folders to trigger automatic execution of malicious code during system boot or user login. Registry Run Keys are registry entries that Windows processes to launch programs automatically, while Startup Folders contain shortcuts or executables that the operating system executes when a user logs in. By leveraging these mechanisms, attackers embed their payloads into legitimate system processes or user environments.

Common Methods & Variations

Modification of Registry Run Keys such as HKCUSoftwareMicrosoftWindowsCurrentVersionRun and HKLM equivalents
Placement of malicious executables or shortcuts in user or all users Startup folders
Use of living-off-the-land binaries (LOLBins) or scripts to create or modify persistence entries
Variations exist across on-premises Windows endpoints and virtual desktop environments; less common in cloud-native systems but possible in hybrid scenarios

Indicators of Compromise (IOCs)

Unexpected or suspicious entries in Registry Run Keys referencing unknown or unusual executables
Presence of unauthorized files or shortcuts in Startup folders
System or security logs showing execution of programs at startup times inconsistent with normal operations
File system artifacts such as recently created or modified files in startup locations

Detection Strategies

Monitoring registry changes and file system modifications in startup locations through endpoint detection and response (EDR) tools
Behavioral analysis to identify anomalous process executions triggered at startup or login
Correlation of logon events with unexpected process launches using security information and event management (SIEM) systems

Mitigation & Prevention

Implement least privilege principles to restrict unauthorized modification of registry keys and startup folders
Use application whitelisting and code signing to control executable content in persistence locations
Employ endpoint protection solutions that monitor and block suspicious persistence attempts
Regularly audit and harden registry and file system permissions related to startup mechanisms

Response Considerations

Immediately remove or disable unauthorized registry entries and startup folder contents
Conduct comprehensive system and network scans to identify related persistence mechanisms or lateral movement
Review user and system logs to determine the scope and timeline of the compromise
Apply patches and update security configurations to prevent re-infection

Related Techniques

Scheduled Task/Job Persistence
Service Registry Permissions Weakness
DLL Search Order Hijacking
Process Injection and Hijacking

Mapping & References

MITRE ATT&CK T1547 – Boot or Logon Autostart Execution
MITRE ATT&CK T1547.001 – Registry Run Keys / Startup Folder
Public research articles and incident reports on persistence techniques in Windows environments

Tags: cyber threats Defense Evasion endpoint security Execution Incident Response Initial Access MITRE ATT&CK persistence Startup Folder Windows Registry