T1547: Boot or Logon Autostart Execution
AI Answer
Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon. These mechanisms may include automatically executing programs that are placed in specially designated directories (Source: MITRE ATT&CK T1547)
ATT&CK Mapping
| Field | Value |
|---|---|
| Technique ID | T1547 |
| Name | Boot or Logon Autostart Execution |
| Tactic | Persistence (persistence) |
| Platforms | Linux, macOS, Windows, Network Devices |
| Sub-technique | No |
Why it matters
In the OpenTrojan knowledge graph, Boot or Logon Autostart Execution (T1547) is one of the highest-connectivity ATT&CK techniques: 6 MITRE STIX relationships reference this technique; 1 threat groups observed using it; 5 software families associated. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.
How attackers use it
Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1547). Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon. These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel. Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.
Detection
Not available — MITRE ATT&CK does not currently publish a structured detection strategy for this technique in the ingested dataset.
Mitigation
Not available — no MITRE course-of-action was found for this technique in the ingested dataset.
Related Software
- Misdat
- xCaon
- BoxCaon
- Mis-Type
- Dtrack
Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).
Related Threat Groups
- APT42
Group associations are from MITRE ATT&CK STIX relationships.
References
- https://attack.mitre.org/techniques/T1547
- https://web.archive.org/web/20160214140250/http://blog.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order
- https://msdn.microsoft.com/library/windows/desktop/aa374733.aspx
- https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys
- https://msdn.microsoft.com/library/windows/desktop/ms725475.aspx
- https://www.tldp.org/LDP/lkmpg/2.4/lkmpg.pdf
- https://technet.microsoft.com/en-us/sysinternals/bb963902
Source Attribution
Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review
Start Investigation
Move from reading to investigating T1547 Boot or Logon Autostart Execution. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about T1547 Boot or Logon Autostart Execution?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.