sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
Gelsemium can set persistence with a Registry run key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Gold Dragon establishes persistence in the Startup folder.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Grandoreiro can use run keys and create link files in the startup folder for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
GrimAgent can set persistence with a Registry run key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
GuLoader can establish persistence via the Registry under `HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce`.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
HTTPBrowser has established persistence by setting the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` key value for `wdm` to the path of the executable. It has also used the Registry entry `HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run vpdn “%ALLUSERPROFILE%\%APPDATA%\vpdn\VPDN_LU.exe”` to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Hancitor  has added Registry Run keys to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Helminth establishes persistence by creating a shortcut in the Start Menu folder.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Heyoka Backdoor can establish persistence with the auto start function including using the value `EverNoteTrayUService`.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Hi-Zor creates a Registry Run key to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
IcedID has established persistence by creating a Registry run key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Some InnaputRAT variants establish persistence by modifying the Registry key `HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\Run:%appdata%\NeutralApp\NeutralApp.exe`.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
InvisiMole can place a lnk file in the Startup Folder to achieve persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Ixeshe can achieve persistence by adding itself to the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` Registry key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
JCry has created payloads in the Startup directory to maintain persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
JHUHUGIT has used a Registry Run key to establish persistence by executing JavaScript code within the rundll32.exe process.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
KOCTOPUS can set the AutoRun Registry key with a PowerShell command.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
A version of KONNI has dropped a Windows shortcut into the Startup folder to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Kasidet creates a Registry Run key to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Kazuar adds a sub-key under several Registry run keys.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Koadic has added persistence to the `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run` Registry key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
LiteDuke can create persistence by adding a shortcut in the `CurrentVersion\Run` Registry key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
LoJax has modified the Registry key `‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’` from `‘autocheck autochk *’` to `‘autocheck autoche *’` in order to execute its payload during Windows startup.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
LookBack sets up a Registry Run key to establish a persistence mechanism.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Lucifer can persist by setting Registry key values `HKLM\Software\Microsoft\Windows\CurrentVersion\Run\QQMusic` and `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\QQMusic`.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
MCMD can use Registry Run Keys for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Machete used the startup folder for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
MarkiRAT can drop its payload into the Startup directory to ensure it automatically runs when the compromised system is started.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Matryoshka can establish persistence by adding Registry Run keys.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Maze has created a file named "startup_vrun.bat" in the Startup folder of a virtual machine to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Metamorfo has configured persistence to the Registry key `HKCU\Software\Microsoft\Windows\CurrentVersion\Run, Spotify =% APPDATA%\Spotify\Spotify.exe` and used .LNK files in the startup folder to achieve persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Mispadu creates a link in the startup folder for persistence. Mispadu adds persistence via the registry key `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Mivast creates the following Registry entry: `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Micromedia`.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
MoleNet can achieve persitence on the infected machine by setting the Registry run key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Mongall can establish persistence with the auto start function including using the value `EverNoteTrayUService`.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Mosquito establishes persistence under the Registry key `HKCU\Software\Run auto_update`.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
The "SCOUT" variant of NETEAGLE achieves persistence by adding itself to the `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` Registry key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
NETWIRE creates a Registry start-up entry to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
NOKKI has established persistence by writing the payload to the Registry key `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
NanHaiShu modifies the %regrun% Registry to point itself to an autostart mechanism.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
NanoCore creates a RunOnce key in the Registry to execute its VBS scripts each time the user logs on to the machine.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
NavRAT creates a Registry key to ensure a file gets executed upon reboot in order to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Nebulae can achieve persistence through a Registry Run key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
ObliqueRAT can gain persistence by a creating a shortcut in the infected user's Startup directory.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Octopus achieved persistence by placing a malicious executable in the startup directory and has added the `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run` key to the Registry.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Okrum establishes persistence by creating a .lnk shortcut to itself in the Startup folder.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
PLAINTEE gains persistence by adding the Registry key `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce`.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
POWERSOURCE achieves persistence by setting a Registry Run key, with the path depending on whether the victim account has user or administrator access.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
POWERTON can install a Registry Run key for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
PUNCHBUGGY has been observed using a Registry Run key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Pisloader establishes persistence via a Registry Run key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
PlugX adds Run key entries in the Registry to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
PoetRAT has added a registry key in the <RUN> hive for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
PoisonIvy creates run key Registry entries pointing to a malicious executable dropped to disk.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
PowerDuke achieves persistence by using various Registry Run keys.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
PowerShower sets up persistence with a Registry run key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
PowerSploit's `New-UserPersistenceOption` Persistence argument can be used to establish via the `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` Registry key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Prikormka adds itself to a Registry Run key with the name guidVGA or guidVSA.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Pteranodon copies itself to the Startup folder to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Pupy adds itself to the startup folder or adds itself to the Registry key `SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run` for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
QakBot can maintain persistence by creating an auto-run Registry key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
If the QuasarRAT client process does not have administrator privileges it will add a registry key to `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
RCSession has the ability to modify a Registry Run key to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
RTM tries to add a Registry Run key under the name "Windows Update" to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Ramsay has created Registry Run keys to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Reaver creates a shortcut file and saves it in a Startup folder to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence. If this fails, it attempts to add Registry Run keys.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Remcos can add itself to the Registry key `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Remexi utilizes Run Registry keys in the HKLM hive as a persistence mechanism.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Rifdoor has created a new registry entry at `HKEY_CURRENT_USERS\Software\Microsoft\Windows\CurrentVersion\Run\Graphics` with a value of `C:\ProgramData\Initech\Initech.exe /run`.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
RogueRobin created a shortcut in the Windows startup folder to launch a PowerShell script each time the user logs in to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Rover persists by creating a Registry entry in `HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\`.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
RunningRAT adds itself to the Registry key `Software\Microsoft\Windows\CurrentVersion\Run` to establish persistence upon reboot.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Ryuk has used the Windows command line to create a Registry entry under `HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
S-Type may create a .lnk file to itself that is saved in the Start menu folder. It may also create the Registry key `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ IMJPMIJ8.1{3 characters of Unique Identifier}`.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
SDBbot has the ability to add a value to the Registry Run key to establish persistence if it detects it is running with regular user privilege.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
SILENTTRINITY can establish a LNK file in the startup folder for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
SMOKEDHAM has used `reg.exe` to create a Registry Run key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
SNUGRIDE establishes persistence through a Registry Run key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
SPACESHIP achieves persistence by creating a shortcut in the current user's Startup folder.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
STARWHALE can establish persistence by installing itself in the startup folder, whereas the GO variant has created a `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OutlookM` registry key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Saint Bot has established persistence by being copied to the Startup directory or through the `\Software\Microsoft\Windows\CurrentVersion\Run` registry key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Most Sakula samples maintain persistence by setting the Registry Run key `SOFTWARE\Microsoft\Windows\CurrentVersion\Run\` in the HKLM or HKCU hive, with the Registry value and file name varying by sample.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
SeaDuke is capable of persisting via the Registry Run key or a .lnk file stored in the Startup directory.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Seasalt creates a Registry entry to ensure infection after reboot under `HKLM\Software\Microsoft\Windows\currentVersion\Run`.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
ServHelper may attempt to establish persistence via the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\` run key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
SharpStage has the ability to create persistence for the malware using the Registry autorun key and startup folder.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
ShimRat has installed a registry based start-up key `HKCU\Software\microsoft\windows\CurrentVersion\Run` to maintain persistence should other methods fail.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Small Sieve has the ability to add itself to `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\OutlookMicrosift` for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Smoke Loader adds a Registry Run key for persistence and adds a script in the Startup folder to deploy the payload.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Snip3 can create a VBS file in startup to persist after system restarts.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
StrongPity can use the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` Registry key for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Sykipot has been known to establish persistence by adding programs to the Run Registry key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
SysUpdate can use a Registry Run key to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
TAINTEDSCRIBE can copy itself into the current user’s Startup folder as “Narrator.exe” for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
TINYTYPHON installs itself under Registry Run key to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
TURNEDUP is capable of writing to a Registry Run key to establish.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Taidoor has modified the `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` key for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
ThreatNeedle can be loaded into the Startup folder (`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\OneDrives.lnk`) as a Shortcut file for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
TinyZBot can create a shortcut in the Windows startup folder for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
TrickBot establishes persistence in the Startup folder.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Trojan.Karagany can create a link to itself in the Startup folder to automatically start itself upon system restart.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Truvasys adds a Registry Run key to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Turian can establish persistence by adding Registry Run keys.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
USBStealer registers itself under a Registry Run key with the name "USB Disk Security."
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Ursnif has used Registry Run keys to establish automatic execution at system startup.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
VBShower used `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\[a-f0-9A-F]{8}` to maintain persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Vasport copies itself to disk and creates an associated run key Registry entry to establish.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
WarzoneRAT can add itself to the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UIF2IS20VK` Registry keys.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Winnti for Windows can add a service named `wind0ws` to the Registry to achieve persistence after reboot.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Xbash can create a Startup item for persistence if it determines it is on a Windows system.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Zebrocy creates an entry in a Registry Run key for the malware to execute on startup.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Zeus Panda adds persistence by creating Registry Run keys.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
build_downer has the ability to add itself to the Registry Run key for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
gh0st RAT has added a Registry Run key to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
njRAT has added persistence via the Registry key `HKCU\Software\Microsoft\CurrentVersion\Run\` and dropped a shortcut in `%STARTUP%`.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Flame can use Windows Authentication Packages for persistence.
Technique: T1547.002 Boot or Logon Autostart Execution: Authentication Package, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Tropic Trooper has created the Registry key `HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell` and sets the value to establish persistence.
Technique: T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Turla established persistence by adding a Shell value under the Registry key `HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon`.
Technique: T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Wizard Spider has established persistence using Userinit by adding the Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.
Technique: T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Bazar can use Winlogon Helper DLL to establish persistence.
Technique: T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Cannon adds the Registry key `HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon` to establish persistence.
Technique: T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL, Tactic: TA0003 Persistence TA0004 Privilege Escalation
DarkTortilla has established persistence via the `Software\Microsoft\Windows NT\CurrentVersion\Winlogon` registry key.
Technique: T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL, Tactic: TA0003 Persistence TA0004 Privilege Escalation
A Dipsind variant registers as a Winlogon Event Notify DLL to establish persistence.
Technique: T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Gazer can establish persistence by setting the value “Shell” with “explorer.exe, %malware_pathfile%” under the Registry key `HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon`.
Technique: T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL, Tactic: TA0003 Persistence TA0004 Privilege Escalation
KeyBoy issues the command `reg add “HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon”` to achieve persistence.
Technique: T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Remexi achieves persistence using Userinit by adding the Registry key `HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit`.
Technique: T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Revenge RAT creates a Registry key at `HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell` to survive a system reboot.
Technique: T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Empire can enumerate Security Support Providers (SSPs) as well as utilize PowerSploit's `Install-SSP` and `Invoke-Mimikatz` to install malicious SSPs and log authentication events.
Technique: T1547.005 Boot or Logon Autostart Execution: Security Support Provider, Tactic: TA0003 Persistence TA0004 Privilege Escalation
The Mimikatz credential dumper contains an implementation of an SSP.
Technique: T1547.005 Boot or Logon Autostart Execution: Security Support Provider, Tactic: TA0003 Persistence TA0004 Privilege Escalation
PowerSploit's `Install-SSP` Persistence module can be used to establish by installing a SSP DLL.
Technique: T1547.005 Boot or Logon Autostart Execution: Security Support Provider, Tactic: TA0003 Persistence TA0004 Privilege Escalation
During Operation CuckooBees, attackers used a signed kernel rootkit to establish additional persistence.
Technique: T1547.006 Boot or Logon Autostart Execution: Kernel Modules and Extensions, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Drovorub can use kernel modules to establish persistence.
Technique: T1547.006 Boot or Logon Autostart Execution: Kernel Modules and Extensions, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Skidmap has the ability to install several loadable kernel modules (LKMs) on infected machines.
Technique: T1547.006 Boot or Logon Autostart Execution: Kernel Modules and Extensions, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Pasam establishes by infecting the Security Accounts Manager (SAM) DLL to load a malicious DLL dropped to disk.
Technique: T1547.008 Boot or Logon Autostart Execution: LSASS Driver, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Wingbird drops a malicious file (sspisrv.dll) alongside a copy of lsass.exe, which is used to register a service that loads sspisrv.dll as a driver. The payload of the malicious driver (located in its entry-point function) is executed when loaded by lsass.exe before the spoofed service becomes unstable and crashes.
Technique: T1547.008 Boot or Logon Autostart Execution: LSASS Driver, Tactic: TA0003 Persistence TA0004 Privilege Escalation
APT39 has modified LNK shortcuts.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Lazarus Group malware has maintained persistence on a system by creating a LNK shortcut in the user’s Startup folder.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Astaroth's initial payload is a malicious .LNK file.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
BACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Bazar can establish persistence by writing shortcuts to the Windows Startup folder.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
The BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Comnie establishes persistence via a .lnk file in the victim’s startup path.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Empire can persist by modifying a .LNK file to include a backdoor.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
FELIXROOT creates a .LNK file for persistence.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Gazer can establish persistence by creating a .lnk file in the Start menu or by modifying existing .lnk files to execute the malware through cmd.exe.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Grandoreiro can write or modify browser shortcuts to enable launching of malicious browser extensions.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Helminth establishes persistence by creating a shortcut.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
InvisiMole can use a .lnk shortcut for the Control Panel to establish persistence.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
A version of KONNI drops a Windows shortcut on the victim’s machine to establish persistence.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Kazuar adds a .lnk file to the Windows startup folder.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
MarkiRAT can modify the shortcut that launches Telegram by replacing its path with the malicious payload to launch with the legitimate executable.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Micropsia creates a shortcut to maintain persistence.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Okrum can establish persistence by creating a .lnk shortcut to itself in the Startup folder.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Reaver creates a shortcut file and saves it in a Startup folder to establish persistence.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
RogueRobin establishes persistence by creating a shortcut (.LNK file) in the Windows startup folder to run a script each time the user logs in.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
S-Type may create the file `%HOMEPATH%\Start Menu\Programs\Startup\Realtek {Unique Identifier}.lnk`, which points to the malicious `msdtc.exe` file already created in the `%CommonFiles%` directory.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
SPACESHIP achieves persistence by creating a shortcut in the current user's Startup folder.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
SeaDuke is capable of persisting via a .lnk file stored in the Startup directory.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
TinyZBot can create a shortcut in the Windows startup folder for persistence.
Technique: T1547.009 Boot or Logon Autostart Execution: Shortcut Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Earth Lusca has added the Registry key `HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Print Processors\UDPrint” /v Driver /d “spool.dll /f` to load malware as a Print Processor.
Technique: T1547.012 Boot or Logon Autostart Execution: Print Processors, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Gelsemium can drop itself in `C:\Windows\System32\spool\prtprocs\x64\winprint.dll` to be loaded automatically by the spoolsv Windows service.
Technique: T1547.012 Boot or Logon Autostart Execution: Print Processors, Tactic: TA0003 Persistence TA0004 Privilege Escalation
The PipeMon installer has modified the Registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Print Processors` to install PipeMon as a Print Processor.
Technique: T1547.012 Boot or Logon Autostart Execution: Print Processors, Tactic: TA0003 Persistence TA0004 Privilege Escalation
CrossRAT can use an XDG Autostart to establish persistence.
Technique: T1547.013 Boot or Logon Autostart Execution: XDG Autostart Entries, Tactic: TA0003 Persistence TA0004 Privilege Escalation
If executing without root privileges, Fysbis adds a `.desktop` configuration file to the user's `~/.config/autostart` directory.
Technique: T1547.013 Boot or Logon Autostart Execution: XDG Autostart Entries, Tactic: TA0003 Persistence TA0004 Privilege Escalation
NETWIRE can use XDG Autostart Entries to establish persistence on Linux systems.
Technique: T1547.013 Boot or Logon Autostart Execution: XDG Autostart Entries, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Pupy can use an XDG Autostart to establish persistence.
Technique: T1547.013 Boot or Logon Autostart Execution: XDG Autostart Entries, Tactic: TA0003 Persistence TA0004 Privilege Escalation
When executing with user-level permissions, RotaJakiro can install persistence using a .desktop file under the `$HOME/.config/autostart/` folder.
Technique: T1547.013 Boot or Logon Autostart Execution: XDG Autostart Entries, Tactic: TA0003 Persistence TA0004 Privilege Escalation
PoisonIvy creates a Registry key in the Active Setup pointing to a malicious executable.
Technique: T1547.014 Boot or Logon Autostart Execution: Active Setup, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Dok uses AppleScript to install a login Item by sending Apple events to the `System Events` process.
Technique: T1547.015 Boot or Logon Autostart Execution: Login Items, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Green Lambert can add Login Items to establish persistence.
Technique: T1547.015 Boot or Logon Autostart Execution: Login Items, Tactic: TA0003 Persistence TA0004 Privilege Escalation
NETWIRE can persist via startup options for Login items.
Technique: T1547.015 Boot or Logon Autostart Execution: Login Items, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Exaramel for Linux can execute commands with high privileges via a specific binary with setuid functionality.
Technique: T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Keydnap adds the setuid flag to a binary so it can easily elevate in the future.
Technique: T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
During Operation Honeybee, the threat actors used the malicious NTWDBLIB.DLL and `cliconfig.exe` to bypass UAC protections.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
APT29 has bypassed UAC.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
APT37 has a function in the initial dropper to bypass Windows UAC in order to execute the next payload with higher privileges.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
BRONZE BUTLER has used a Windows 10 specific tool and xxmm to bypass UAC for privilege escalation.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Cobalt Group has bypassed UAC.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Earth Lusca has used the Fodhelper UAC bypass technique to gain elevated privileges.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Evilnum has used PowerShell to bypass UAC.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
MuddyWater uses various techniques to bypass UAC.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Patchwork bypassed User Access Control (UAC).
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
A Threat Group-3390 tool can use a public UAC bypass method to elevate privileges.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
AppleJeus has presented the user with a UAC prompt to elevate privileges while installing.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
AutoIt backdoor attempts to escalate privileges by bypassing User Access Control.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Avaddon bypasses UAC using the CMSTPLUA COM interface.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
BADHATCH can utilize the CMSTPLUA COM interface and the SilentCleanup task to bypass UAC.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Bad Rabbit has attempted to bypass UAC and gain elevated administrative privileges.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
BitPaymer can suppress UAC prompts by setting the `HKCU\Software\Classes\ms-settings\shell\open\command` registry key on Windows 10 or `HKCU\Software\Classes\mscfile\shell\open\command` on Windows 7 and launching the `eventvwr.msc` process, which launches BitPaymer with elevated privileges.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
BlackCat can bypass UAC to escalate privileges.
Technique: T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation