Boot or Logon Autostart Execution: Active Setup T1547.014

Tactics: Persistence, Privilege Escalation

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine. Active Setup is a Windows mechanism that is used to execute programs when a user logs in. The value stored in the Registry key will be executed after a user logs into the computer. These programs will be executed under the context of the user and will have the account's associated permissions level.

Events covered

4 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 4 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (8 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
registry_path2contains 2\\control\\lsa, \\software\\microsoft\\active setup\\installed components
registry_value_name2eq 1, in 1AuditBaseDirectories, AuditBaseObjects, CrashOnAuditFail, StubPath
CommandLine1contains 1/cfg, /configure, /db
Details1length_compare 10, >
Image1ends_with 1\secedit.exe
OriginalFileName1eq 1secedit
TargetObject1wildcard 1hkey_users\*\control panel\desktop\scrnsave.exe, hkey_users\*\environment\userinitmprlogonscript, hkey_users\*\software\microsoft\command processor\autorun
event.type1eq 1change

Top indicator values (67 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
CommandLinecontains
/cfg
12
CommandLinecontains
/configure
12
CommandLinecontains
/db
12
CommandLinecontains
/export
12
Detailslength_compare
0
14
Detailslength_compare
>
14
Imageends_with
\secedit.exe
1
OriginalFileNameeq
secedit
1
TargetObjectwildcard
hkey_users\*\control panel\desktop\scrnsave.exe
1
TargetObjectwildcard
hkey_users\*\environment\userinitmprlogonscript
12
TargetObjectwildcard
hkey_users\*\software\microsoft\command processor\autorun
12
TargetObjectwildcard
hkey_users\*\software\microsoft\ctf\langbaraddin\*\filepath
12
TargetObjectwildcard
hkey_users\*\software\microsoft\internet explorer\extensions\*\exec
12
TargetObjectwildcard
hkey_users\*\software\microsoft\internet explorer\extensions\*\script
12
TargetObjectwildcard
hkey_users\*\software\microsoft\windows nt\currentversion\windows\load
12
TargetObjectwildcard
hkey_users\*\software\microsoft\windows nt\currentversion\windows\run
1
TargetObjectwildcard
hkey_users\*\software\microsoft\windows nt\currentversion\winlogon\shell
12
TargetObjectwildcard
hkey_users\*\software\microsoft\windows\currentversion\policies\explorer\run\*
13
TargetObjectwildcard
hkey_users\*\software\microsoft\windows\currentversion\policies\system\shell
12
TargetObjectwildcard
hkey_users\*\software\policies\microsoft\windows\system\scripts\logoff\script
12
TargetObjectwildcard
hkey_users\*\software\policies\microsoft\windows\system\scripts\logon\script
12
TargetObjectwildcard
hkey_users\*\software\policies\microsoft\windows\system\scripts\shutdown\script
12
TargetObjectwildcard
hkey_users\*\software\policies\microsoft\windows\system\scripts\startup\script
12
TargetObjectwildcard
hklm\software\microsoft\active setup\installed components\*\shellcomponent
1
TargetObjectwildcard
hklm\software\microsoft\command processor\autorun
1
TargetObjectwildcard
hklm\software\microsoft\ctf\langbaraddin\*\filepath
1
TargetObjectwildcard
hklm\software\microsoft\internet explorer\extensions\*\exec
1
TargetObjectwildcard
hklm\software\microsoft\internet explorer\extensions\*\script
1
TargetObjectwildcard
hklm\software\microsoft\windows ce services\autostartonconnect\microsoftactivesync
1
TargetObjectwildcard
hklm\software\microsoft\windows ce services\autostartondisconnect\microsoftactivesync
1

Exclusions (21 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
Detailseq
%windir%\system32\Ribbons.scr
1
Detailseq
%windir%\system32\rundll32.exe user32.dll,LockWorkStation
1
Detailseq
C:\Windows\System32\poqexec.exe /skip_critical_poq /display_progress...
1
Detailseq
C:\windows\System32\poqexec.exe /display_progress \SystemRoot\WinSxS\pending.xml
1
Detailseq
scrnsave.scr
1
Detailswildcard
C:\Program Files (x86)\*.exe
1
Detailswildcard
C:\Program Files\*.exe
1
Detailswildcard
C:\Windows\system32\userinit.exe
1
Detailswildcard
cmd.exe
1
Imagewildcard
c:\program files (x86)\*.exe
1
Imagewildcard
c:\program files\*.exe
1
Imagewildcard
c:\programdata\microsoft\windows defender\platform\*\msmpeng.exe
1
Imagewildcard
c:\windows\system32\msiexec.exe
1
Imagewildcard
c:\windows\syswow64\msiexec.exe
1
TargetObjectwildcard
*\software\microsoft\internet explorer\extensions\*\script
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 1 rule

Elastic 1 rule

Splunk 2 rules