Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1547.001

Events covered

13 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 87 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (36 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Top indicator values (941 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Exclusions (401 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 39 rules

• Classes Autorun Keys Modification
• Common Autorun Keys Modification
• CurrentControlSet Autorun Keys Modification
• CurrentVersion Autorun Keys Modification
• CurrentVersion NT Autorun Keys Modification
• Direct Autorun Keys Modification
• File Creation In Suspicious Directory By Msdt.EXE
• Forest Blizzard APT - Custom Protocol Handler Creation
• Forest Blizzard APT - Custom Protocol Handler DLL Registry Set
• Internet Explorer Autorun Keys Modification
• Kapeka Backdoor Autorun Persistence
• Leviathan Registry Key Activity
• Modify User Shell Folders Startup Value
• Narrator's Feedback-Hub Persistence
• New RUN Key Pointing to Suspicious Folder
• Office Autorun Keys Modification
• Potential KamiKakaBot Activity - Winlogon Shell Persistence
• Potential Persistence Attempt Via Run Keys Using Reg.EXE
• Potential Ryuk Ransomware Activity
• Potential Startup Shortcut Persistence Via PowerShell.EXE
• Potential Suspicious Activity Using SeCEdit
• Registry Persistence via Explorer Run Key
• Registry Set With Crypto-Classes From The "Cryptography" PowerShell Namespace
• Session Manager Autorun Keys Modification
• Startup Folder File Write
• Suspicious Autorun Registry Modified via WMI
• Suspicious PowerShell In Registry Run Keys
• Suspicious Run Key from Download
• Suspicious Startup Folder Persistence
• Suspicious VBScript UN2452 Pattern
• System Scripts Autorun Keys Modification
• User Shell Folders Registry Modification via CommandLine
• VBScript Payload Stored in Registry
• Windows Event Log Access Tampering Via Registry
• WinRAR Creating Files in Startup Locations
• WinSock2 Autorun Keys Modification
• Wow6432Node Classes Autorun Keys Modification
• Wow6432Node CurrentVersion Autorun Keys Modification
• Wow6432Node Windows NT CurrentVersion Autorun Keys Modification

Elastic 14 rules

• Execution of Persistent Suspicious Program
• Lateral Movement via Startup Folder
• Persistence via a Windows Installer
• Persistence via Hidden Run Key Detected
• Persistence via WMI Standard Registry Provider
• Persistent Scripts in the Startup Directory
• Potential Persistence via Mandatory User Profile
• Potential REMCOS Trojan Execution
• Shortcut File Written or Modified on Startup Folder
• Startup Folder Persistence via Unsigned Process
• Startup or Run Key Registry Modification
• Startup Persistence by a Suspicious Process
• Suspicious Startup Shell Folder Modification
• Uncommon Registry Persistence Change

Splunk 24 rules

• Add DLL_EXE Registry Value (Sysmon)
• Execution from Startup Folder (Sysmon)
• Execution from Startup Folder (Windows Event Log)
• File Written to Startup Folder - Windows (Sysmon)
• File Written to Startup Folder - Windows (Windows Event Log)
• New AutoRun Registry Key (PowerShell)
• Potential Proxy Malware via AutoRun Key (PowerShell)
• Potential Proxy Malware via AutoRun Key (Sysmon)
• Potential Proxy Malware via AutoRun Key (Windows Event Log)
• Registry Keys Used For Persistence
• Shortcut Created in Startup Folder - Windows (PowerShell)
• Startup Folder Location Modified - Windows (PowerShell)
• Startup Folder Location Modified - Windows (Sysmon)
• Startup Folder Location Modified - Windows (Windows Event Log)
• Suspicious Registry Key Created (PowerShell)
• Suspicious Registry Key Created (Windows Event Log)
• Windows Boot or Logon Autostart Execution In Startup Folder
• Windows NorthStar C2 Agent Execution
• Windows PowerShell MSIX Package Installation
• Windows Registry BootExecute Modification
• Windows Registry Modification for Safe Mode Persistence
• Wow6432Node Classes Autorun Keys Modification (PowerShell)
• Wow6432Node Classes Autorun Keys Modification (Sysmon)
• Wow6432Node Classes Autorun Keys Modification (Windows Event Log)

Kusto 2 rules

• Powershell Empire Cmdlets Executed in Command Line
• Registry Run Keys - Suspicious Registry Run Keys

YARA-L 8 rules

• CurrentControlSet Autorun Keys Modification
• CurrentVersion Autorun Keys Modification
• Direct Autorun Keys Modification
• Modify User Shell Folders Startup Value
• New RUN Key Pointing to Suspicious Folder
• Potential Suspicious Activity Using SeCEdit
• Session Manager Autorun Keys Modification
• Suspicious Powershell In Registry Run Keys