T1547.001PersistencePrivilege Escalation
Registry Run Keys / Startup Folder
Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level. The following run…
CVEs1
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.1
Reports0
Detections
39 Sigma rules tagged T1547.001Registry Run Keys / Startup FolderT1547.00139 general rules
- Leviathan Registry Key Activitycriticaltest
- Potential Ryuk Ransomware Activityhighstable
- File Creation In Suspicious Directory By Msdt.EXEhightest
- Forest Blizzard APT - Custom Protocol Handler Creationhightest
- Forest Blizzard APT - Custom Protocol Handler DLL Registry Sethightest
- Kapeka Backdoor Autorun Persistencehightest
- Modify User Shell Folders Startup Valuehightest
- Narrator's Feedback-Hub Persistencehightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Registry Run Keys / Startup Folder
1 CVE, by priority. Each link shows its badge.- CVE-2022-22047Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation VulnerabilityMITRE CTID mapping of the KEV entry · follow-on activity18.8%Top 2.7%62.9priority