Boot or Logon Autostart Execution `T1547`

Tactics: Persistence, Privilege Escalation

Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon. These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel.

Events covered

41 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 5	Process terminated
Sysmon	Event ID 7	Image loaded
Sysmon	Event ID 11	FileCreate
Sysmon	Event ID 12	RegistryEvent (Object create and delete)
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 14	RegistryEvent (Key and Value Rename)
Sysmon	Event ID 23	FileDelete (File Delete archived)
Security-Auditing	Event ID 4622	A security package has been loaded by the Local Security Authority.
Security-Auditing	Event ID 4648	A logon was attempted using explicit credentials.
Security-Auditing	Event ID 4656	A handle to an object was requested.
Security-Auditing	Event ID 4657	A registry value was modified.
Security-Auditing	Event ID 4663	An attempt was made to access an object.
Security-Auditing	Event ID 4664	An attempt was made to create a hard link.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4689	A process has exited.
Security-Auditing	Event ID 5136	A directory service object was modified.
Security-Auditing	Event ID 5145	A network share object was checked to see whether client can be granted desired access.
Security-Auditing	Event ID 6416	A new external device was recognized by the system.
Defender-DeviceRegistryEvents	any	Registry activity
Defender-DeviceRegistryEvents	RegistryKeyDeleted	Registry key deleted
Defender-DeviceRegistryEvents	RegistryValueSet	Registry value set
Defender-DeviceRegistryEvents	RegistryValueDeleted	Registry value deleted
Defender-DeviceRegistryEvents	RegistryKeyRenamed	Registry key renamed
ESF	exec	Process Execution
ESF	fork	Process Fork
ESF	write	File Write
ESF	kextload	Kernel Extension Load
ESF	kextunload	Kernel Extension Unload
Linux-Auditd	Event ID 1300	SYSCALL
Linux-Auditd	Event ID 1309	EXECVE
Linux-Auditd	Event ID 1327	PROCTITLE
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
PrintService	Event ID 316	Printer driver param1 for param2 param3 was added or updated.
PrintService	Event ID 808	The print spooler failed to load a plug-in module PluginDllName, error code ErrorCode.
PrintService	Event ID 4909	Print Service event 4909 (manifest stub).
PowerShell	Event ID 800	Event ID 800
Service-Control-Manager	Event ID 7045	A service was installed in the system.
Sysmon-for-Linux	Event ID 1	Process Create
Sysmon-for-Linux	Event ID 11	File created

Authoring guide

These 252 rules share fields, values, and exclusions.

Fields filtered most (107 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`TargetObject`	80	`contains` 40, `wildcard` 28, `ends_with` 20, `regex_match` 3, `eq` 1	`h\software\microsoft\windows\currentversion\policies\exp...`, `h\software\microsoft\windows\currentversion\run\`, `h\software\wow6432node\microsoft\windows\currentversion\...`, `\software\microsoft\windows\currentversion\policies\explorer\run\`, `\software\microsoft\windows\currentversion\run`
`Details`	64	`is_not_null` 22, `eq` 20, `contains` 13, `ends_with` 11, `is_null` 8, `starts_with` 6, `length_compare` 2, `regex_match` 2, `wildcard` 2	`(empty)`, `.dll`, `-encodedcommand` , `-noni` , `-noninteractive`
`EventType`	63	`eq` 47, `ne` 13, `in` 10	`start`, `deletion`, `exec`, `modification`, `load_module`
`Image`	58	`ends_with` 28, `eq` 17, `starts_with` 16, `is_not_null` 7, `contains` 4, `wildcard` 4, `is_null` 2, `regex_match` 2	`\reg.exe`, `?:\`, `?:\windows\`, `\appdata\roaming\spotify\spotify.exe`, `\device\mup`
`TargetFilename`	56	`wildcard` 33, `contains` 14, `ends_with` 7, `starts_with` 6, `eq` 3, `in` 2, `regex_match` 1	`?:\\microsoft\windows\start menu\programs\startup\`, `?:\programdata\microsoft\windows\start menu\programs\startup\`, `?:\users\\appdata\roaming\microsoft\windows\start...`, `\start menu\programs\startup\`, `c:\programdata\microsoft\windows\start menu\programs\startup\*`
`process_name`	49	`eq` 38, `in` 7, `wildcard` 3, `regex_match` 2, `starts_with` 2, `is_not_null` 1	`bash`, `cscript.exe`, `kmod`, `chmod`, `cmd.exe`
`host.os.type`	48	`eq` 48
`EventID`	39	`eq` 38, `in` 1	`4104`, `4688`, `4103`, `13`, `1`
`event.type`	39	`eq` 29, `ne` 7, `in` 4	`start`, `change`, `deletion`, `creation`, `process_started`
`CommandLine`	30	`contains` 24, `wildcard` 4, `regex_match` 2, `ends_with` 1, `in` 1	`add` , `/cfg`, `/configure`, `/db`, `execute`
`file.name`	17	`is_not_null` 11, `eq` 4, `wildcard` 2, `contains` 1, `length_compare` 1, `ne` 1	`..`, `:`, `Microsoft`, `com.adobe.plist`, `com.apple.plist`
`event.category`	16	`eq` 13, `in` 3	`file`, `registry`, `driver`, `process`
`process.args`	15	`eq` 7, `wildcard` 6, `in` 5, `starts_with` 5, `contains` 2	`.EndpointSecurity`, `.ko`, `EndpointSecurity.kext`, `/bin/base64-d`, `/bin/chmod +x`
`parent_process_name`	14	`eq` 6, `regex_match` 4, `in` 3, `wildcard` 1	`excel.exe`, `(?i)\QMicrosoft\Windows\Start Menu\Programs\StartUp\E`, `(?i)winlogon\.exe`, `eqnedt32.exe`, `explorer.exe`
`OriginalFileName`	10	`eq` 9, `in` 1	`reg.exe`, `cscript.exe`, `mshta.exe`, `powershell.exe`, `installutil.exe`

Top indicator values (2439 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.type`	`eq`	`start` elasticBPF Program or Map Load via bpftool elasticElastic Endpoint Security Kernel Extension Unload elasticExecutable Bit Set for Potential Persistence Script elasticExecution of Persistent Suspicious Program elasticKernel Load or Unload via Kexec Detected elasticKernel Module Load from Unusual Location elasticKernel Module Load via Built-in Utility elasticKernel Module Removal elasticLoadable Kernel Module Load Followed by Log Clearing elasticLoadable Kernel Module Loaded via Loader elasticLoadable Kernel Module Loaded via Unusual Parent elasticNetwork Connections Initiated Through XDG Autostart Entry elasticNew System Kext File and Immediate Load via KextLoad elasticPersistence via GenAI Tool elasticPod or Container Creation with Suspicious Command-Line +2 more rules	17	1078
`event.type`	`eq`	`change` elasticInstallation of Security Support Provider elasticPersistence via Hidden Run Key Detected elasticPersistence via WMI Standard Registry Provider elasticPotential LSA Authentication Package Abuse elasticPotential Persistence via Time Provider Modification elasticPotential Port Monitor or Print Processor Registration Abuse elasticStartup or Run Key Registry Modification elasticSuspicious Startup Shell Folder Modification elasticUncommon Registry Persistence Change	9	94
`Details`	`eq`	`(empty)` sigmaAtbroker Registry Change sigmaClasses Autorun Keys Modification sigmaCommon Autorun Keys Modification sigmaCurrentControlSet Autorun Keys Modification sigmaCurrentVersion Autorun Keys Modification sigmaCurrentVersion NT Autorun Keys Modification sigmaInternet Explorer Autorun Keys Modification sigmaOffice Autorun Keys Modification sigmaSession Manager Autorun Keys Modification sigmaSystem Scripts Autorun Keys Modification sigmaWinSock2 Autorun Keys Modification sigmaWow6432Node Classes Autorun Keys Modification sigmaWow6432Node CurrentVersion Autorun Keys Modification sigmaWow6432Node Windows NT CurrentVersion Autorun Keys Modification	14	2
`EventType`	`ne`	`deletion` elasticDual Persistence via Startup and Scheduled Task elasticMicrosoft Office Process Setting Persistence via Startup elasticPersistence via a Process from a Removable or Mounted ISO Device elasticRegistry or File Modification from Suspicious Memory elasticScript File Written to Startup Folder elasticScript Interpreter Process Writing to Commonly Abused Persistence Locations elasticStartup Persistence by a Low Reputation Process elasticStartup Persistence from a Browser or Compression Utility Descendant elasticStartup Persistence via Microsoft Office Descendant Process elasticStartup Persistence via Unusual Process elasticStartup Persistence via Windows Script Interpreter elasticUntrusted Process Writing to Commonly Abused Persistence Locations elasticUnusual File Written or Modified in Startup Folder	13	86
`EventType`	`eq`	`start` elasticNetwork Connection via Startup Item elasticPersistence via a Process from a Removable or Mounted ISO Device elasticPotential Execution via Shortcut Modification elasticRegistry Modification via Microsoft Office elasticRegistry Persistence via Microsoft Office Descendant Process elasticRegistry Run Key Modified by Unusual Process elasticScript Interpreter Process Writing to Commonly Abused Persistence Locations elasticStartup Persistence by a Low Reputation Process elasticStartup Persistence from a Browser or Compression Utility Descendant elasticStartup Persistence via Microsoft Office Descendant Process elasticStartup Persistence via Windows Script Interpreter elasticSuspicious Shortcut Modification	12	391
`EventType`	`eq`	`modification` elasticAuthorization Plugin Modification elasticPersistence via a Windows Installer elasticPersistence via DirectoryService Plugin Modification elasticPersistence via Docker Shortcut Modification elasticSuspicious BootExecute Registry Modification elasticSuspicious Registry Modification via WMI elasticSuspicious Startup Persistence via a Windows Installer elasticSuspicious Windows Authentication Registry Modification elasticUncommon Persistence via Registry Modification	9	72
`TargetObject`	`wildcard`	`hkey_users\*\environment\userinitmprlogonscript` elasticDual Persistence via Startup and Scheduled Task elasticPersistence via a Process from a Removable or Mounted ISO Device elasticPersistence via WMI Standard Registry Provider elasticRegistry Modification via Microsoft Office elasticRegistry or File Modification from Suspicious Memory elasticRegistry Persistence via Microsoft Office Descendant Process elasticStartup Persistence by a Low Reputation Process elasticStartup Persistence from a Browser or Compression Utility Descendant elasticSuspicious Registry Modification via WMI elasticUncommon Persistence via Registry Modification elasticUncommon Registry Persistence Change elasticUntrusted Process Writing to Commonly Abused Persistence Locations	12	12
`TargetObject`	`wildcard`	`hkey_users\*\software\microsoft\windows nt\currentversion\windows\load` elasticDual Persistence via Startup and Scheduled Task elasticPersistence via a Process from a Removable or Mounted ISO Device elasticPersistence via WMI Standard Registry Provider elasticRegistry Modification via Microsoft Office elasticRegistry or File Modification from Suspicious Memory elasticRegistry Persistence via Microsoft Office Descendant Process elasticStartup Persistence by a Low Reputation Process elasticStartup Persistence from a Browser or Compression Utility Descendant elasticSuspicious Registry Modification via WMI elasticUncommon Persistence via Registry Modification elasticUncommon Registry Persistence Change elasticUntrusted Process Writing to Commonly Abused Persistence Locations	12	12
`TargetObject`	`wildcard`	`hkey_users\*\software\microsoft\windows nt\currentversion\winlogon\shell` elasticDual Persistence via Startup and Scheduled Task elasticPersistence via a Process from a Removable or Mounted ISO Device elasticPersistence via WMI Standard Registry Provider elasticRegistry Modification via Microsoft Office elasticRegistry or File Modification from Suspicious Memory elasticRegistry Persistence via Microsoft Office Descendant Process elasticStartup Persistence by a Low Reputation Process elasticStartup Persistence from a Browser or Compression Utility Descendant elasticSuspicious Registry Modification via WMI elasticUncommon Persistence via Registry Modification elasticUncommon Registry Persistence Change elasticUntrusted Process Writing to Commonly Abused Persistence Locations	12	12
`TargetObject`	`wildcard`	`h\software\microsoft\windows\currentversion\policies\explorer\run\` elasticDual Persistence via Startup and Scheduled Task elasticPersistence via a Process from a Removable or Mounted ISO Device elasticPersistence via a Windows Installer elasticRegistry or File Modification from Suspicious Memory elasticStartup Persistence by a Low Reputation Process elasticStartup Persistence from a Browser or Compression Utility Descendant elasticStartup Persistence from Backed RWX Memory elasticStartup Persistence via Windows Script Interpreter elasticSuspicious Startup Persistence via a Windows Installer elasticSuspicious String Value Written to Registry Run Key elasticUntrusted Process Writing to Commonly Abused Persistence Locations	11	11
`TargetObject`	`wildcard`	`h\software\microsoft\windows\currentversion\run\` elasticDual Persistence via Startup and Scheduled Task elasticPersistence via a Process from a Removable or Mounted ISO Device elasticPersistence via a Windows Installer elasticRegistry or File Modification from Suspicious Memory elasticStartup Persistence by a Low Reputation Process elasticStartup Persistence from a Browser or Compression Utility Descendant elasticStartup Persistence from Backed RWX Memory elasticStartup Persistence via Windows Script Interpreter elasticSuspicious Startup Persistence via a Windows Installer elasticSuspicious String Value Written to Registry Run Key elasticUntrusted Process Writing to Commonly Abused Persistence Locations	11	12
`TargetObject`	`wildcard`	`h\software\wow6432node\microsoft\windows\currentversion\policies\explorer\run\` elasticDual Persistence via Startup and Scheduled Task elasticPersistence via a Process from a Removable or Mounted ISO Device elasticPersistence via a Windows Installer elasticRegistry or File Modification from Suspicious Memory elasticStartup Persistence by a Low Reputation Process elasticStartup Persistence from a Browser or Compression Utility Descendant elasticStartup Persistence from Backed RWX Memory elasticStartup Persistence via Windows Script Interpreter elasticSuspicious Startup Persistence via a Windows Installer elasticSuspicious String Value Written to Registry Run Key elasticUntrusted Process Writing to Commonly Abused Persistence Locations	11	11
`TargetObject`	`wildcard`	`h\software\wow6432node\microsoft\windows\currentversion\run\` elasticDual Persistence via Startup and Scheduled Task elasticPersistence via a Process from a Removable or Mounted ISO Device elasticPersistence via a Windows Installer elasticRegistry or File Modification from Suspicious Memory elasticStartup Persistence by a Low Reputation Process elasticStartup Persistence from a Browser or Compression Utility Descendant elasticStartup Persistence from Backed RWX Memory elasticStartup Persistence via Windows Script Interpreter elasticSuspicious Startup Persistence via a Windows Installer elasticSuspicious String Value Written to Registry Run Key elasticUntrusted Process Writing to Commonly Abused Persistence Locations	11	11
`TargetObject`	`wildcard`	`hkey_users\*\software\microsoft\command processor\autorun` elasticDual Persistence via Startup and Scheduled Task elasticPersistence via a Process from a Removable or Mounted ISO Device elasticPersistence via WMI Standard Registry Provider elasticRegistry Modification via Microsoft Office elasticRegistry or File Modification from Suspicious Memory elasticRegistry Persistence via Microsoft Office Descendant Process elasticStartup Persistence by a Low Reputation Process elasticStartup Persistence from a Browser or Compression Utility Descendant elasticSuspicious Registry Modification via WMI elasticUncommon Persistence via Registry Modification elasticUncommon Registry Persistence Change	11	11
`TargetObject`	`wildcard`	`hkey_users\\software\microsoft\ctf\langbaraddin\\filepath` elasticDual Persistence via Startup and Scheduled Task elasticPersistence via a Process from a Removable or Mounted ISO Device elasticPersistence via WMI Standard Registry Provider elasticRegistry Modification via Microsoft Office elasticRegistry or File Modification from Suspicious Memory elasticRegistry Persistence via Microsoft Office Descendant Process elasticStartup Persistence by a Low Reputation Process elasticStartup Persistence from a Browser or Compression Utility Descendant elasticSuspicious Registry Modification via WMI elasticUncommon Persistence via Registry Modification elasticUncommon Registry Persistence Change	11	11
`TargetObject`	`wildcard`	`hkey_users\\software\microsoft\internet explorer\extensions\\exec` elasticDual Persistence via Startup and Scheduled Task elasticPersistence via a Process from a Removable or Mounted ISO Device elasticPersistence via WMI Standard Registry Provider elasticRegistry Modification via Microsoft Office elasticRegistry or File Modification from Suspicious Memory elasticRegistry Persistence via Microsoft Office Descendant Process elasticStartup Persistence by a Low Reputation Process elasticStartup Persistence from a Browser or Compression Utility Descendant elasticSuspicious Registry Modification via WMI elasticUncommon Persistence via Registry Modification elasticUncommon Registry Persistence Change	11	11
`TargetObject`	`wildcard`	`hkey_users\*\software\microsoft\windows\currentversion\policies\system\shell` elasticDual Persistence via Startup and Scheduled Task elasticPersistence via a Process from a Removable or Mounted ISO Device elasticPersistence via WMI Standard Registry Provider elasticRegistry Modification via Microsoft Office elasticRegistry or File Modification from Suspicious Memory elasticRegistry Persistence via Microsoft Office Descendant Process elasticStartup Persistence by a Low Reputation Process elasticStartup Persistence from a Browser or Compression Utility Descendant elasticSuspicious Registry Modification via WMI elasticUncommon Persistence via Registry Modification elasticUncommon Registry Persistence Change	11	11
`TargetObject`	`wildcard`	`hkey_users\*\software\policies\microsoft\windows\system\scripts\logoff\script` elasticDual Persistence via Startup and Scheduled Task elasticPersistence via a Process from a Removable or Mounted ISO Device elasticPersistence via WMI Standard Registry Provider elasticRegistry Modification via Microsoft Office elasticRegistry or File Modification from Suspicious Memory elasticRegistry Persistence via Microsoft Office Descendant Process elasticStartup Persistence by a Low Reputation Process elasticStartup Persistence from a Browser or Compression Utility Descendant elasticSuspicious Registry Modification via WMI elasticUncommon Persistence via Registry Modification elasticUncommon Registry Persistence Change	11	11
`TargetObject`	`wildcard`	`hkey_users\*\software\policies\microsoft\windows\system\scripts\logon\script` elasticDual Persistence via Startup and Scheduled Task elasticPersistence via a Process from a Removable or Mounted ISO Device elasticPersistence via WMI Standard Registry Provider elasticRegistry Modification via Microsoft Office elasticRegistry or File Modification from Suspicious Memory elasticRegistry Persistence via Microsoft Office Descendant Process elasticStartup Persistence by a Low Reputation Process elasticStartup Persistence from a Browser or Compression Utility Descendant elasticSuspicious Registry Modification via WMI elasticUncommon Persistence via Registry Modification elasticUncommon Registry Persistence Change	11	11
`TargetObject`	`wildcard`	`hkey_users\*\software\policies\microsoft\windows\system\scripts\shutdown\script` elasticDual Persistence via Startup and Scheduled Task elasticPersistence via a Process from a Removable or Mounted ISO Device elasticPersistence via WMI Standard Registry Provider elasticRegistry Modification via Microsoft Office elasticRegistry or File Modification from Suspicious Memory elasticRegistry Persistence via Microsoft Office Descendant Process elasticStartup Persistence by a Low Reputation Process elasticStartup Persistence from a Browser or Compression Utility Descendant elasticSuspicious Registry Modification via WMI elasticUncommon Persistence via Registry Modification elasticUncommon Registry Persistence Change	11	11
`TargetObject`	`wildcard`	`hkey_users\*\software\policies\microsoft\windows\system\scripts\startup\script` elasticDual Persistence via Startup and Scheduled Task elasticPersistence via a Process from a Removable or Mounted ISO Device elasticPersistence via WMI Standard Registry Provider elasticRegistry Modification via Microsoft Office elasticRegistry or File Modification from Suspicious Memory elasticRegistry Persistence via Microsoft Office Descendant Process elasticStartup Persistence by a Low Reputation Process elasticStartup Persistence from a Browser or Compression Utility Descendant elasticSuspicious Registry Modification via WMI elasticUncommon Persistence via Registry Modification elasticUncommon Registry Persistence Change	11	11
`TargetObject`	`wildcard`	`hklm\software\microsoft\windows nt\currentversion\winlogon\shell` elasticDual Persistence via Startup and Scheduled Task elasticPersistence via a Process from a Removable or Mounted ISO Device elasticRegistry or File Modification from Suspicious Memory elasticStartup Persistence by a Low Reputation Process elasticStartup Persistence from a Browser or Compression Utility Descendant elasticSuspicious Registry Modification via WMI elasticUncommon Persistence via Registry Modification elasticUncommon Registry Persistence Change	8	8
`TargetObject`	`wildcard`	`hklm\software\microsoft\windows nt\currentversion\winlogon\userinit` elasticDual Persistence via Startup and Scheduled Task elasticPersistence via a Process from a Removable or Mounted ISO Device elasticRegistry or File Modification from Suspicious Memory elasticStartup Persistence by a Low Reputation Process elasticStartup Persistence from a Browser or Compression Utility Descendant elasticSuspicious Registry Modification via WMI elasticUncommon Persistence via Registry Modification elasticUncommon Registry Persistence Change	8	8
`event.category`	`eq`	`file` elasticKernel Object File Creation elasticPersistence via a Process from a Removable or Mounted ISO Device elasticPersistence via a Windows Installer elasticPotential Persistence via Login Hook elasticPotential REMCOS Trojan Execution elasticScript Interpreter Process Writing to Commonly Abused Persistence Locations elasticStartup Persistence by a Low Reputation Process elasticStartup Persistence from a Browser or Compression Utility Descendant elasticStartup Persistence via Windows Script Interpreter elasticSuspicious Modprobe File Event elasticSuspicious Startup Persistence via a Windows Installer	11	43
`event.category`	`eq`	`registry` elasticPersistence via a Process from a Removable or Mounted ISO Device elasticPersistence via a Windows Installer elasticPotential REMCOS Trojan Execution elasticScript Interpreter Process Writing to Commonly Abused Persistence Locations elasticStartup Persistence by a Low Reputation Process elasticStartup Persistence from a Browser or Compression Utility Descendant elasticStartup Persistence via Windows Script Interpreter elasticSuspicious Startup Persistence via a Windows Installer	8	14
`EventID`	`eq`	`4104` splunkLSA Authentication Packages Registry Key Modified (PowerShell) splunkNew AutoRun Registry Key (PowerShell) splunkPotential LSA password filter (PowerShell) splunkPotential Proxy Malware via AutoRun Key (PowerShell) splunkShortcut Created in Startup Folder - Windows (PowerShell) splunkStartup Folder Location Modified - Windows (PowerShell) splunkSymbolic OR Hard File Link Created (PowerShell) splunkWindows PowerShell MSIX Package Installation splunkWinLogon Registry Key Modified (PowerShell) splunkWow6432Node Classes Autorun Keys Modification (PowerShell)	10	269
`EventID`	`eq`	`4688` splunkExecution from Startup Folder (Windows Event Log) splunkLSA Authentication Packages Registry Key Modified (Windows Event Log) splunkPotential LSA password filter (Windows Event Log) splunkPotential Proxy Malware via AutoRun Key (Windows Event Log) splunkStartup Folder Location Modified - Windows (Windows Event Log) splunkSymbolic OR Hard File Link Created (Windows Event Log) splunkUnusual winlogon.exe Child Process (Windows Event Log) splunkWow6432Node Classes Autorun Keys Modification (Windows Event Log) kustoMidnight Blizzard - suspicious rundll32.exe execution of vbscript kustoPowershell Empire Cmdlets Executed in Command Line	10	317
`TargetFilename`	`wildcard`	`?:\programdata\microsoft\windows\start menu\programs\startup\*` elasticLateral Movement via Startup Folder elasticMicrosoft Office Process Setting Persistence via Startup elasticPersistence via a Windows Installer elasticPersistence via GenAI Tool elasticPersistent Scripts in the Startup Directory elasticScript File Written to Startup Folder elasticStartup Persistence via Microsoft Office Descendant Process elasticStartup Persistence via Unusual Process elasticSuspicious Startup Persistence via a Windows Installer elasticUnusual File Written or Modified in Startup Folder	10	12
`TargetFilename`	`wildcard`	`?:\users\\appdata\roaming\microsoft\windows\start menu\programs\startup\` elasticLateral Movement via Startup Folder elasticMicrosoft Office Process Setting Persistence via Startup elasticPersistence via a Windows Installer elasticPersistence via GenAI Tool elasticPersistent Scripts in the Startup Directory elasticScript File Written to Startup Folder elasticStartup Persistence via Microsoft Office Descendant Process elasticStartup Persistence via Unusual Process elasticSuspicious Startup Persistence via a Windows Installer elasticUnusual File Written or Modified in Startup Folder	10	13
`TargetFilename`	`wildcard`	`?:\\microsoft\windows\start menu\programs\startup\` elasticDual Persistence via Startup and Scheduled Task elasticPersistence via a Process from a Removable or Mounted ISO Device elasticRegistry or File Modification from Suspicious Memory elasticScript Interpreter Process Writing to Commonly Abused Persistence Locations elasticStartup Persistence by a Low Reputation Process elasticStartup Persistence from a Browser or Compression Utility Descendant elasticStartup Persistence from Backed RWX Memory elasticStartup Persistence via Windows Script Interpreter elasticUntrusted Process Writing to Commonly Abused Persistence Locations	9	9

Exclusions (1456 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`Details`	`eq`	`(empty)` sigmaAtbroker Registry Change sigmaClasses Autorun Keys Modification sigmaCommon Autorun Keys Modification sigmaCurrentControlSet Autorun Keys Modification sigmaCurrentVersion Autorun Keys Modification sigmaCurrentVersion NT Autorun Keys Modification sigmaInternet Explorer Autorun Keys Modification sigmaOffice Autorun Keys Modification sigmaSession Manager Autorun Keys Modification sigmaSystem Scripts Autorun Keys Modification sigmaWinSock2 Autorun Keys Modification sigmaWow6432Node Classes Autorun Keys Modification sigmaWow6432Node CurrentVersion Autorun Keys Modification sigmaWow6432Node Windows NT CurrentVersion Autorun Keys Modification chronicleSession Manager Autorun Keys Modification	15
`process.code_signature.trusted`	`eq`	`true` elasticPersistence via a Process from a Removable or Mounted ISO Device elasticPersistence via Suspicious Launch Agent or Launch Daemon elasticRegistry or File Modification from Suspicious Memory elasticRegistry Persistence via Microsoft Office Descendant Process elasticRegistry Run Key Modified by Unusual Process elasticRegistry Run Key Prefixed with Asterisk elasticScript File Written to Startup Folder elasticStartup Persistence via Microsoft Office Descendant Process elasticStartup Persistence via Windows Script Interpreter elasticSuspicious BootExecute Registry Modification elasticSuspicious Shortcut Modification elasticSuspicious String Value Written to Registry Run Key elasticSuspicious Windows Authentication Registry Modification	13
`Image`	`wildcard`	`?:\program files (x86)\*.exe` elasticRegistry or File Modification from Suspicious Memory elasticRegistry Run Key Prefixed with Asterisk elasticScript File Written to Startup Folder elasticStartup Persistence from a Browser or Compression Utility Descendant elasticStartup Persistence from Backed RWX Memory elasticSuspicious Shortcut Modification elasticSuspicious String Value Written to Registry Run Key elasticSuspicious Windows Authentication Registry Modification elasticUnusual File Written or Modified in Startup Folder	9
`Image`	`wildcard`	`?:\program files\*.exe` elasticRegistry or File Modification from Suspicious Memory elasticRegistry Run Key Prefixed with Asterisk elasticScript File Written to Startup Folder elasticStartup Persistence from a Browser or Compression Utility Descendant elasticStartup Persistence from Backed RWX Memory elasticSuspicious Shortcut Modification elasticSuspicious String Value Written to Registry Run Key elasticSuspicious Windows Authentication Registry Modification elasticUnusual File Written or Modified in Startup Folder	9
`Image`	`wildcard`	`?:\windows\system32\msiexec.exe` elasticPotential Persistence via Time Provider Modification elasticRegistry Run Key Modified by Unusual Process elasticRegistry Run Key Prefixed with Asterisk elasticStartup or Run Key Registry Modification elasticSuspicious String Value Written to Registry Run Key elasticSuspicious Windows Authentication Registry Modification elasticUnusual File Written or Modified in Startup Folder	7
`Image`	`wildcard`	`?:\windows\syswow64\msiexec.exe` elasticRegistry Run Key Modified by Unusual Process elasticStartup or Run Key Registry Modification elasticSuspicious String Value Written to Registry Run Key elasticSuspicious Windows Authentication Registry Modification elasticUnusual File Written or Modified in Startup Folder	5
`user.id`	`eq`	`s-1-5-18` elasticPotential LSA Authentication Package Abuse elasticPotential Port Monitor or Print Processor Registration Abuse elasticStartup or Run Key Registry Modification elasticStartup Persistence by a Low Reputation Process elasticStartup Persistence via Unusual Process elasticSuspicious Shortcut Modification elasticUncommon Persistence via Registry Modification elasticUnusual File Written or Modified in Startup Folder	8
`process_name`	`eq`	`rundll32.exe` elasticRegistry Run Key Modified by Unusual Process elasticStartup Persistence via Microsoft Office Descendant Process elasticStartup Persistence via Unusual Process elasticSuspicious Shortcut Modification elasticSuspicious String Value Written to Registry Run Key elasticUncommon Registry Persistence Change	6
`process_name`	`eq`	`cscript.exe` elasticRegistry Run Key Modified by Unusual Process elasticStartup Persistence via Unusual Process elasticStartup Persistence via Windows Script Interpreter elasticSuspicious Shortcut Modification elasticSuspicious String Value Written to Registry Run Key	5
`process_name`	`eq`	`powershell.exe` elasticRegistry Run Key Modified by Unusual Process elasticScript Interpreter Process Writing to Commonly Abused Persistence Locations elasticStartup Persistence via Unusual Process elasticStartup Persistence via Windows Script Interpreter elasticSuspicious Shortcut Modification	5
`Image`	`ends_with`	`\officeclicktorun.exe` sigmaCommon Autorun Keys Modification sigmaCurrentVersion Autorun Keys Modification sigmaCurrentVersion NT Autorun Keys Modification sigmaOffice Autorun Keys Modification sigmaWow6432Node CurrentVersion Autorun Keys Modification	5
`Image`	`starts_with`	`c:\program files\common files\microsoft shared\clicktorun\` sigmaCommon Autorun Keys Modification sigmaCurrentVersion Autorun Keys Modification sigmaCurrentVersion NT Autorun Keys Modification sigmaOffice Autorun Keys Modification sigmaWow6432Node CurrentVersion Autorun Keys Modification	5
`SignatureStatus`	`wildcard`	`errorCode_endpoint*` elasticDual Persistence via Startup and Scheduled Task elasticStartup Persistence from a Browser or Compression Utility Descendant elasticStartup Persistence from Backed RWX Memory elasticUntrusted Process Writing to Commonly Abused Persistence Locations elasticUnusual File Written or Modified in Startup Folder	5
`SignatureStatus`	`wildcard`	`errorExpired` elasticDual Persistence via Startup and Scheduled Task elasticStartup Persistence from a Browser or Compression Utility Descendant elasticStartup Persistence from Backed RWX Memory elasticUntrusted Process Writing to Commonly Abused Persistence Locations elasticUnusual File Written or Modified in Startup Folder	5
`Details`	`wildcard`	`:\Program Files (x86)\` elasticRegistry Run Key Modified by Unusual Process elasticStartup or Run Key Registry Modification elasticSuspicious String Value Written to Registry Run Key elasticSuspicious Windows Authentication Registry Modification	4

Boot or Logon Autostart Execution `T1547`

Events covered

Authoring guide

Fields filtered most (107 distinct)

Top indicator values (2439 distinct)

Exclusions (1456 distinct)

Rules under this technique

Sigma 74 rules

Elastic 92 rules

Splunk 68 rules

Kusto 9 rules

YARA-L 9 rules

Boot or Logon Autostart Execution T1547

Events covered

Authoring guide

Fields filtered most (107 distinct)

Top indicator values (2439 distinct)

Exclusions (1456 distinct)

Rules under this technique

Sigma 74 rules

Elastic 92 rules

Splunk 68 rules

Kusto 9 rules

YARA-L 9 rules

Boot or Logon Autostart Execution `T1547`