Boot or Logon Autostart Execution

What is Boot or Logon Autostart Execution?

Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon. These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel. Common autostart locations on Windows include the Run and RunOnce registry keys, Startup folder locations, services configured to start automatically, and the Winlogon registry key. On Linux and macOS, init scripts, systemd units, and launch agents provide similar functionality. Understanding these autostart mechanisms is essential for security analysts who need to identify malicious persistence during incident response investigations.

“Boot or Logon Autostart Execution is documented as technique T1547 in the MITRE ATT&CK knowledge base under the Persistence tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Boot or Logon Autostart Execution activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor Windows Registry modifications to HKLM and HKCU Run and RunOnce keys, alerting on new entries pointing to executables in user-writable locations or using obfuscated command line arguments.

2. 2

   Track file creation events in Windows Startup folder locations for all users, including AllUsers and per-user startup folders, which are commonly used for persistence by malware that does not require administrative privileges.

3. 3

   Monitor service creation and modification events, focusing on services created outside of standard software installation processes or services pointing to executables in non-standard locations.

4. 4

   Implement file integrity monitoring on autostart script locations on Linux systems including /etc/init.d/, systemd unit directories, and user-specific .bashrc and .profile files that execute on login.

5. 5

   Correlate autostart location modifications with the process that made the change and the user context, as legitimate applications typically modify these locations only during installation with elevated privileges.

Example Alerts

These realistic alert examples show what Boot or Logon Autostart Execution looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Boot or Logon Autostart Execution?

SOC analysts detect Boot or Logon Autostart Execution (T1547) by monitoring XDR, SIEM telemetry for behavioral anomalies and specific indicators. Key detection methods include monitor windows registry modifications to hklm and hkcu run and runonce keys, alerting on new entries pointing to executables in user-writable locatio. SOCSimulator provides hands-on practice detecting this technique with realistic alerts.

What security tools are used to detect Boot or Logon Autostart Execution?

Boot or Logon Autostart Execution can be detected using XDR, SIEM platforms. XDR tools are particularly effective for this technique because they provide visibility into the persistence phase of the attack chain. SOCSimulator simulates all three tool types for hands-on training.

How common is Boot or Logon Autostart Execution in real-world attacks?

Boot or Logon Autostart Execution is a well-documented MITRE ATT&CK technique in the Persistence tactic. It appears in threat intelligence reports from multiple security vendors and has been observed in campaigns by various threat actor groups. SOCSimulator includes realistic Boot or Logon Autostart Execution scenarios based on documented attack patterns, helping analysts build detection intuition.

Can I practice detecting Boot or Logon Autostart Execution for free?

Yes. SOCSimulator offers free forever access to training scenarios, including Persistence techniques like Boot or Logon Autostart Execution. You can investigate realistic alerts in guided Operations rooms, build detection skills with SIEM, XDR, and Firewall interfaces, and test yourself under pressure in Shift Mode. No credit card required.