T1547.001: Registry Run Keys / Startup Folder — MITRE ATT&CK Technique

Description

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.(Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account's associated permissions level.

The following run keys are created by default on Windows systems:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

Run keys may exist under multiple hives.(Citation: Microsoft Wow6432Node 2018)(Citation: Malwarebytes Wow6432Node 2016) The HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency.(Citation: Microsoft Run Key) For example, it is possible to load a DLL at logon using a "Depend" key with RunOnceEx: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "C:\temp\evil[.]dll" (Citation: Oddvar Moe RunOnceEx Mar 2018)

Placing a program within a startup folder will also cause that program to execute when a user logs in. There is a startup folder location for individual user accounts as well as a system-wide startup folder that will be checked regardless of which user account logs in. The startup folder path for the current user is C:\Users\\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup. The startup folder path for all users is C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp.

The following Registry keys can be used to set startup folder items for persistence:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

The following Registry keys can control automatic startup of services during boot:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices

Using policy settings to specify startup programs creates corresponding values in either of two Registry keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Programs listed in the load value of the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows run automatically for the currently logged-on user.

By default, the multistring BootExecute value of the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager is set to autocheck autochk *. This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally. Adversaries can add other programs or processes to this registry value which will automatically launch at boot.

Adversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use Masquerading to make the Registry entries look as if they are associated with legitimate programs.

Platforms

Windows

Threat Groups (57)

ID	Group	Context
G1043	BlackByte	[BlackByte](https://attack.mitre.org/groups/G1043) has used Registry Run keys for persistence.(Citation: Microsoft BlackByte 2023)
G0022	APT3	[APT3](https://attack.mitre.org/groups/G0022) places scripts in the startup folder for persistence.(Citation: FireEye Operation Double Tap)
G0094	Kimsuky	[Kimsuky](https://attack.mitre.org/groups/G0094) has placed scripts in the startup folder for persistence and modified the `HKEY_CURRENT_USER\Software...
G0040	Patchwork	[Patchwork](https://attack.mitre.org/groups/G0040) has added the path of its second-stage malware to the startup folder to achieve persistence. One of...
G0096	APT41	[APT41](https://attack.mitre.org/groups/G0096) created and modified startup files for persistence.(Citation: FireEye APT41 Aug 2019)(Citation: Group I...
G0035	Dragonfly	[Dragonfly](https://attack.mitre.org/groups/G0035) has added the registry value ntdll to the Registry Run key to establish persistence.(Citation: US-C...
G0078	Gorgon Group	[Gorgon Group](https://attack.mitre.org/groups/G0078) malware can create a .lnk file and add a Registry Run key to establish persistence.(Citation: Un...
G0050	APT32	[APT32](https://attack.mitre.org/groups/G0050) established persistence using Registry Run keys, both to execute PowerShell and VBS scripts as well as ...
G0069	MuddyWater	[MuddyWater](https://attack.mitre.org/groups/G0069) has added Registry Run key <code>KCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemTextEncod...
G0019	Naikon	[Naikon](https://attack.mitre.org/groups/G0019) has modified a victim's Windows Run registry to establish persistence.(Citation: Bitdefender Naikon Ap...
G0037	FIN6	[FIN6](https://attack.mitre.org/groups/G0037) has used Registry Run keys to establish persistence for its downloader tools known as HARDTACK and SHIPB...
G0047	Gamaredon Group	[Gamaredon Group](https://attack.mitre.org/groups/G0047) tools have registered Run keys in the registry to give malicious VBS files persistence.(Citat...
G1046	Storm-1811	[Storm-1811](https://attack.mitre.org/groups/G1046) has created Windows Registry Run keys that execute various batch scripts to establish persistence ...
G0139	TeamTNT	[TeamTNT](https://attack.mitre.org/groups/G0139) has added batch scripts to the startup folder.(Citation: ATT TeamTNT Chimaera September 2020)
G0046	FIN7	[FIN7](https://attack.mitre.org/groups/G0046) malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to ...
G0026	APT18	[APT18](https://attack.mitre.org/groups/G0026) establishes persistence via the <code>HKCU\Software\Microsoft\Windows\CurrentVersion\Run</code> key.(Ci...
G0121	Sidewinder	[Sidewinder](https://attack.mitre.org/groups/G0121) has added paths to executables in the Registry to establish persistence.(Citation: Rewterz Sidewin...
G0129	Mustang Panda	[Mustang Panda](https://attack.mitre.org/groups/G0129) has created the registry key <code>HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Cu...
G0128	ZIRCONIUM	[ZIRCONIUM](https://attack.mitre.org/groups/G0128) has created a Registry Run key named <code>Dropbox Update Setup</code> to establish persistence for...
G0106	Rocke	[Rocke](https://attack.mitre.org/groups/G0106)'s miner has created UPX-packed files in the Windows Start Menu Folder.(Citation: Talos Rocke August 201...

Associated Software (201)

ID	Name	Type	Context
S0266	TrickBot	Malware	[TrickBot](https://attack.mitre.org/software/S0266) establishes persistence in the Startup folder.(Citation: ESET Trickbot Oct 2020)
S0139	PowerDuke	Malware	[PowerDuke](https://attack.mitre.org/software/S0139) achieves persistence by using various Registry Run keys.(Citation: Volexity PowerDuke November 20...
S1145	Pikabot	Malware	[Pikabot](https://attack.mitre.org/software/S1145) maintains persistence following system checks through the Run key in the registry.(Citation: Zscale...
S0662	RCSession	Malware	[RCSession](https://attack.mitre.org/software/S0662) has the ability to modify a Registry Run key to establish persistence.(Citation: Trend Micro DRBC...
S0417	GRIFFON	Malware	[GRIFFON](https://attack.mitre.org/software/S0417) has used a persistence module that stores the implant inside the Registry, which executes at logon....
S1025	Amadey	Malware	[Amadey](https://attack.mitre.org/software/S1025) has changed the Startup folder to the one containing its executable by overwriting the registry keys...
S0353	NOKKI	Malware	[NOKKI](https://attack.mitre.org/software/S0353) has established persistence by writing the payload to the Registry key <code>HKCU\Software\Microsoft\...
S0093	Backdoor.Oldrea	Malware	[Backdoor.Oldrea](https://attack.mitre.org/software/S0093) adds Registry Run keys to achieve persistence.(Citation: Symantec Dragonfly)(Citation: Giga...
S1053	AvosLocker	Malware	[AvosLocker](https://attack.mitre.org/software/S1053) has been executed via the `RunOnce` Registry key to run itself on safe mode.(Citation: Trend Mic...
S1041	Chinoxy	Malware	[Chinoxy](https://attack.mitre.org/software/S1041) has established persistence via the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` registry k...
S0546	SharpStage	Malware	[SharpStage](https://attack.mitre.org/software/S0546) has the ability to create persistence for the malware using the Registry autorun key and startup...
S0226	Smoke Loader	Malware	[Smoke Loader](https://attack.mitre.org/software/S0226) adds a Registry Run key for persistence and adds a script in the Startup folder to deploy the ...
S0082	Emissary	Malware	Variants of [Emissary](https://attack.mitre.org/software/S0082) have added Run Registry keys to establish persistence.(Citation: Emissary Trojan Feb 2...
S9018	HeartCrypt	Malware	[HeartCrypt](https://attack.mitre.org/software/S9018) can set the `CurrentVersion\Run` key to establish persistence.(Citation: Palo Alto HeartCrypt DE...
S0386	Ursnif	Malware	[Ursnif](https://attack.mitre.org/software/S0386) has used Registry Run keys to establish automatic execution at system startup.(Citation: TrendMicro ...
S0665	ThreatNeedle	Malware	[ThreatNeedle](https://attack.mitre.org/software/S0665) can be loaded into the Startup folder (`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startu...
S1212	RansomHub	Malware	[RansomHub](https://attack.mitre.org/software/S1212) has created an autorun Registry key through the `-safeboot-instance -pass` command line argument....
S0153	RedLeaves	Malware	[RedLeaves](https://attack.mitre.org/software/S0153) attempts to add a shortcut file in the Startup folder to achieve persistence. If this fails, it a...
S0145	POWERSOURCE	Malware	[POWERSOURCE](https://attack.mitre.org/software/S0145) achieves persistence by setting a Registry Run key, with the path depending on whether the vict...
S9034	Tsundere Botnet	Malware	[Tsundere Botnet](https://attack.mitre.org/software/S9034) has created a value in the `HKCU:\Software\Microsoft\Windows\CurrentVersion\Run` Registry k...

References

Frequently Asked Questions

What is T1547.001 (Registry Run Keys / Startup Folder)?

T1547.001 is a MITRE ATT&CK technique named 'Registry Run Keys / Startup Folder'. It belongs to the Persistence, Privilege Escalation tactic(s). Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause th...

How can T1547.001 be detected?

Detection of T1547.001 (Registry Run Keys / Startup Folder) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.

What mitigations exist for T1547.001?

Follow defense-in-depth principles including network segmentation, least privilege access, security monitoring, and regular patching to reduce the risk of this technique.

Which threat groups use T1547.001?

Known threat groups using T1547.001 include: BlackByte, APT3, Kimsuky, Patchwork, APT41, Dragonfly, Gorgon Group, APT32.