sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
If running with `root` permissions, OSX_OCEANLOTUS.D can create a persistence file in the folder `/Library/LaunchDaemons`.
Technique: T1543.004 Create or Modify System Process: Launch Daemon, Tactic: TA0003 Persistence TA0004 Privilege Escalation
When running with root privileges after a Launch Agent is installed, ThiefQuest installs a plist file to the `/Library/LaunchDaemons/` folder with the `RunAtLoad` key set to `true` establishing persistence as a Launch Daemon.
Technique: T1543.004 Create or Modify System Process: Launch Daemon, Tactic: TA0003 Persistence TA0004 Privilege Escalation
XCSSET uses the ssh launchdaemon to elevate privileges, bypass system controls, and enable remote access to the victim.
Technique: T1543.004 Create or Modify System Process: Launch Daemon, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Pacu can set up S3 bucket notifications to trigger a malicious Lambda function when a CloudFormation template is uploaded to the bucket. It can also create Lambda functions that trigger upon the creation of users, roles, and groups.
Technique: T1546 Event Triggered Execution, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Kimsuky has a HWP document stealer module which changes the default program association in the registry to open HWP documents.
Technique: T1546.001 Event Triggered Execution: Change Default File Association, Tactic: TA0003 Persistence TA0004 Privilege Escalation
SILENTTRINITY can conduct an image hijack of an `.msc` file extension as part of its UAC bypass process.
Technique: T1546.001 Event Triggered Execution: Change Default File Association, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Gazer can establish persistence through the system screensaver by configuring it to execute the malware.
Technique: T1546.002 Event Triggered Execution: Screensaver, Tactic: TA0003 Persistence TA0004 Privilege Escalation
During Operation Ghost, APT29 used WMI event subscriptions to establish persistence for malware.
Technique: T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription, Tactic: TA0003 Persistence TA0004 Privilege Escalation
During the SolarWinds Compromise, APT29 used a WMI event filter to invoke a command-line event consumer at system boot time to launch a backdoor with `rundll32.exe`.
Technique: T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription, Tactic: TA0003 Persistence TA0004 Privilege Escalation
APT29 has used WMI event subscriptions for persistence.
Technique: T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription, Tactic: TA0003 Persistence TA0004 Privilege Escalation
APT33 has attempted to use WMI event subscriptions to establish persistence on compromised hosts.
Technique: T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Blue Mockingbird has used mofcomp.exe to establish WMI Event Subscription persistence mechanisms configured from a *.mof file.
Technique: T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription, Tactic: TA0003 Persistence TA0004 Privilege Escalation
FIN8 has used WMI event subscriptions for persistence.
Technique: T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription, Tactic: TA0003 Persistence TA0004 Privilege Escalation
HEXANE has used WMI event subscriptions for persistence.
Technique: T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Leviathan has used WMI for persistence.
Technique: T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Metador has established persistence through the use of a WMI event subscription combined with unusual living-off-the-land binaries such as `cdb.exe`.
Technique: T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Mustang Panda's custom ORat tool uses a WMI event consumer to maintain persistence.
Technique: T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Rancor has complied VBScript-generated MOF files into WMI event subscriptions for persistence.
Technique: T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Turla has used WMI event filters and consumers to establish persistence.
Technique: T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription, Tactic: TA0003 Persistence TA0004 Privilege Escalation
BADHATCH can use WMI event subscriptions for persistence.
Technique: T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription, Tactic: TA0003 Persistence TA0004 Privilege Escalation
HOPLIGHT can use WMI event subscriptions to create persistence.
Technique: T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Kevin can compile randomly-generated MOF files into the WMI repository to persistently run malware.
Technique: T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription, Tactic: TA0003 Persistence TA0004 Privilege Escalation
POSHSPY uses a WMI event subscription to establish persistence.
Technique: T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription, Tactic: TA0003 Persistence TA0004 Privilege Escalation
POWERTON can use WMI for persistence.
Technique: T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription, Tactic: TA0003 Persistence TA0004 Privilege Escalation
PoshC2 has the ability to persist on a system using WMI events.
Technique: T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription, Tactic: TA0003 Persistence TA0004 Privilege Escalation
RegDuke can persist using a WMI consumer that is launched every time a process named WINWORD.EXE is started.
Technique: T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription, Tactic: TA0003 Persistence TA0004 Privilege Escalation
SILENTTRINITY can create a WMI Event to execute a payload for persistence.
Technique: T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Sardonic can use a WMI event filter to invoke a command-line event consumer to gain persistence.
Technique: T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription, Tactic: TA0003 Persistence TA0004 Privilege Escalation
SeaDuke uses an event filter in WMI code to execute a previously dropped executable shortly after system startup.
Technique: T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription, Tactic: TA0003 Persistence TA0004 Privilege Escalation
TrailBlazer has the ability to use WMI for persistence.
Technique: T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription, Tactic: TA0003 Persistence TA0004 Privilege Escalation
adbupd can use a WMI script to achieve persistence.
Technique: T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription, Tactic: TA0003 Persistence TA0004 Privilege Escalation
metaMain registered a WMI event subscription consumer called "hard_disk_stat" to establish persistence.
Technique: T1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Green Lambert can establish persistence on a compromised host through modifying the `profile`, `login`, and run command (rc) files associated with the `bash`, `csh`, and `tcsh` shells.
Technique: T1546.004 Event Triggered Execution: Unix Shell Configuration Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Linux Rabbit maintains persistence on an infected machine through rc.local and .bashrc files.
Technique: T1546.004 Event Triggered Execution: Unix Shell Configuration Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
When executing with non-root level permissions, RotaJakiro can install persistence by adding a command to the .bashrc file that executes a binary in the  `${HOME}/.gvfsd/.profile/` folder.
Technique: T1546.004 Event Triggered Execution: Unix Shell Configuration Modification, Tactic: TA0003 Persistence TA0004 Privilege Escalation
netsh can be used as a persistence proxy technique to execute a helper DLL when netsh.exe is executed.
Technique: T1546.007 Event Triggered Execution: Netsh Helper DLL, Tactic: TA0003 Persistence TA0004 Privilege Escalation
APT29 used sticky-keys to obtain unauthenticated, privileged console access.
Technique: T1546.008 Event Triggered Execution: Accessibility Features, Tactic: TA0003 Persistence TA0004 Privilege Escalation
APT3 replaces the Sticky Keys binary `C:\Windows\System32\sethc.exe` for persistence.
Technique: T1546.008 Event Triggered Execution: Accessibility Features, Tactic: TA0003 Persistence TA0004 Privilege Escalation
APT41 leveraged sticky keys to establish persistence.
Technique: T1546.008 Event Triggered Execution: Accessibility Features, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Axiom actors have been known to use the Sticky Keys replacement within RDP sessions to obtain persistence.
Technique: T1546.008 Event Triggered Execution: Accessibility Features, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Deep Panda has used the sticky-keys technique to bypass the RDP login screen on remote systems during intrusions.
Technique: T1546.008 Event Triggered Execution: Accessibility Features, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Fox Kitten has used sticky keys to launch a command prompt.
Technique: T1546.008 Event Triggered Execution: Accessibility Features, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Empire can leverage WMI debugging to remotely replace binaries like sethc.exe, Utilman.exe, and Magnify.exe with cmd.exe.
Technique: T1546.008 Event Triggered Execution: Accessibility Features, Tactic: TA0003 Persistence TA0004 Privilege Escalation
PUNCHBUGGY can establish using a AppCertDLLs Registry key.
Technique: T1546.009 Event Triggered Execution: AppCert DLLs, Tactic: TA0003 Persistence TA0004 Privilege Escalation
APT39 has used malware to set `LoadAppInit_DLLs` in the Registry key `SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows` in order to establish persistence.
Technique: T1546.010 Event Triggered Execution: AppInit DLLs, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Some variants of Cherry Picker use AppInit_DLLs to achieve persistence by creating the following Registry key: `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows "AppInit_DLLs"="pserver32.dll"`
Technique: T1546.010 Event Triggered Execution: AppInit DLLs, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Ramsay can insert itself into the address space of other applications using the AppInit DLL Registry key.
Technique: T1546.010 Event Triggered Execution: AppInit DLLs, Tactic: TA0003 Persistence TA0004 Privilege Escalation
If a victim meets certain criteria, T9000 uses the AppInit_DLL functionality to achieve persistence by ensuring that every user mode process that is spawned will load its malicious DLL, ResN32.dll. It does this by creating the following Registry keys: `HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs – %APPDATA%\Intel\ResN32.dll` and `HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs – 0x1`.
Technique: T1546.010 Event Triggered Execution: AppInit DLLs, Tactic: TA0003 Persistence TA0004 Privilege Escalation
FIN7 has used application shim databases for persistence.
Technique: T1546.011 Event Triggered Execution: Application Shimming, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Pillowmint has used a malicious shim database to maintain persistence.
Technique: T1546.011 Event Triggered Execution: Application Shimming, Tactic: TA0003 Persistence TA0004 Privilege Escalation
SDBbot has the ability to use application shimming for persistence if it detects it is running as admin on Windows XP or 7, by creating a shim database to patch services.exe.
Technique: T1546.011 Event Triggered Execution: Application Shimming, Tactic: TA0003 Persistence TA0004 Privilege Escalation
ShimRat has installed shim databases in the `AppPatch` folder.
Technique: T1546.011 Event Triggered Execution: Application Shimming, Tactic: TA0003 Persistence TA0004 Privilege Escalation
During the C0032 campaign, TEMP.Veles modified and added entries within `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options` to maintain persistence.
Technique: T1546.012 Event Triggered Execution: Image File Execution Options Injection, Tactic: TA0003 Persistence TA0004 Privilege Escalation
SDBbot has the ability to use image file execution options for persistence if it detects it is running with admin privileges on a Windows version newer than Windows 7.
Technique: T1546.012 Event Triggered Execution: Image File Execution Options Injection, Tactic: TA0003 Persistence TA0004 Privilege Escalation
SUNBURST created an Image File Execution Options (IFEO) Debugger registry value for the process `dllhost.exe` to trigger the installation of Cobalt Strike.
Technique: T1546.012 Event Triggered Execution: Image File Execution Options Injection, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Turla has used PowerShell profiles to maintain persistence on an infected machine.
Technique: T1546.013 Event Triggered Execution: PowerShell Profile, Tactic: TA0003 Persistence TA0004 Privilege Escalation
APT28 has used COM hijacking for persistence by replacing the legitimate `MMDeviceEnumerator` object with a payload.
Technique: T1546.015 Event Triggered Execution: Component Object Model Hijacking, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Some variants of ADVSTORESHELL achieve persistence by registering the payload as a Shell Icon Overlay handler COM object.
Technique: T1546.015 Event Triggered Execution: Component Object Model Hijacking, Tactic: TA0003 Persistence TA0004 Privilege Escalation
BBSRAT has been seen persisting via COM hijacking through replacement of the COM object for MruPidlList `{42aedc87-2188-41fd-b9a3-0c966feabec1}` or Microsoft WBEM New Event Subsystem `{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}` depending on the system's CPU architecture.
Technique: T1546.015 Event Triggered Execution: Component Object Model Hijacking, Tactic: TA0003 Persistence TA0004 Privilege Escalation
ComRAT samples have been seen which hijack COM objects for persistence by replacing the path to shell32.dll in registry location `HKCU\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32`.
Technique: T1546.015 Event Triggered Execution: Component Object Model Hijacking, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Ferocious can use COM hijacking to establish persistence.
Technique: T1546.015 Event Triggered Execution: Component Object Model Hijacking, Tactic: TA0003 Persistence TA0004 Privilege Escalation
JHUHUGIT has used COM hijacking to establish persistence by hijacking a class named MMDeviceEnumerator and also by registering the payload as a Shell Icon Overlay handler COM object ({3543619C-D563-43f7-95EA-4DA7E1CC396A}).
Technique: T1546.015 Event Triggered Execution: Component Object Model Hijacking, Tactic: TA0003 Persistence TA0004 Privilege Escalation
KONNI has modified ComSysApp service to load the malicious DLL payload.
Technique: T1546.015 Event Triggered Execution: Component Object Model Hijacking, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Mosquito uses COM hijacking as a method of persistence.
Technique: T1546.015 Event Triggered Execution: Component Object Model Hijacking, Tactic: TA0003 Persistence TA0004 Privilege Escalation
PcShare has created the `HKCU\\Software\\Classes\\CLSID\\{42aedc87-2188-41fd-b9a3-0c966feabec1}\\InprocServer32` Registry key for persistence.
Technique: T1546.015 Event Triggered Execution: Component Object Model Hijacking, Tactic: TA0003 Persistence TA0004 Privilege Escalation
SILENTTRINITY can add a CLSID key for payload execution through `Registry.CurrentUser.CreateSubKey("Software\\Classes\\CLSID\\{" + clsid + "}\\InProcServer32")`.
Technique: T1546.015 Event Triggered Execution: Component Object Model Hijacking, Tactic: TA0003 Persistence TA0004 Privilege Escalation
SVCReady has created the `HKEY_CURRENT_USER\Software\Classes\CLSID\{E6D34FFC-AD32-4d6a-934C-D387FA873A19}` Registry key for persistence.
Technique: T1546.015 Event Triggered Execution: Component Object Model Hijacking, Tactic: TA0003 Persistence TA0004 Privilege Escalation
WarzoneRAT  can perform COM hijacking by setting the path to itself to the `HKCU\Software\Classes\Folder\shell\open\command` key with a `DelegateExecute` parameter.
Technique: T1546.015 Event Triggered Execution: Component Object Model Hijacking, Tactic: TA0003 Persistence TA0004 Privilege Escalation
During AppleJeus's installation process, it uses `postinstall` scripts to extract a hidden plist from the application's `/Resources` folder and execute the `plist` file as a Launch Daemon with elevated permissions.
Technique: T1546.016 Event Triggered Execution: Installer Packages, Tactic: TA0003 Persistence TA0004 Privilege Escalation
BoxCaon established persistence by setting the `HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load` registry key to point to its executable.
Technique: T1547 Boot or Logon Autostart Execution, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Dtrack’s RAT makes a persistent target file with auto execution on the host start.
Technique: T1547 Boot or Logon Autostart Execution, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Mis-Type has created registry keys for persistence, including `HKCU\Software\bkfouerioyou`, `HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{6afa8072-b2b1-31a8-b5c1-{Unique Identifier}`, and `HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{3BF41072-B2B1-31A8-B5C1-{Unique Identifier}`.
Technique: T1547 Boot or Logon Autostart Execution, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Misdat has created registry keys for persistence, including `HKCU\Software\dnimtsoleht\StubPath`, `HKCU\Software\snimtsOleht\StubPath`, `HKCU\Software\Backtsaleht\StubPath`, `HKLM\SOFTWARE\Microsoft\Active Setup\Installed. Components\{3bf41072-b2b1-21c8-b5c1-bd56d32fbda7}`, and `HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{3ef41072-a2f1-21c8-c5c1-70c2c3bc7905}`.
Technique: T1547 Boot or Logon Autostart Execution, Tactic: TA0003 Persistence TA0004 Privilege Escalation
xCaon has added persistence via the Registry key `HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load` which causes the malware to run each time any user logs in.
Technique: T1547 Boot or Logon Autostart Execution, Tactic: TA0003 Persistence TA0004 Privilege Escalation
During Operation Dream Job, Lazarus Group placed LNK files into the victims' startup folder for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
During Operation Sharpshooter, a first-stage downloader installed Rising Sun to `%Startup%\mssync.exe` on a compromised host.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
APT18 establishes persistence via the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
An APT19 HTTP malware variant establishes persistence by setting the Registry key `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows Debug Tools-%LOCALAPPDATA%\`.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
APT28 has deployed malware that has copied itself to the startup directory for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
APT29 added Registry Run keys to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
APT3 places scripts in the startup folder for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
APT32 established persistence using Registry Run keys, both to execute PowerShell and VBS scripts as well as to execute their backdoor directly.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
APT33 has deployed a tool known as DarkComet to the Startup folder of a victim, and used Registry run keys to gain persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
APT37's has added persistence via the Registry key `HKCU\Software\Microsoft\CurrentVersion\Run\`.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
APT39 has maintained persistence using the startup folder.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
APT41 created and modified startup files for persistence. APT41 added a registry key in `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost` to establish persistence for Cobalt Strike.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
BRONZE BUTLER has used a batch script that adds a Registry Run key to establish malware persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Cobalt Group has used Registry Run keys for persistence. The group has also set a Startup path to launch the PowerShell shell command and download Cobalt Strike.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Confucius has dropped malicious files into the startup folder `%AppData%\Microsoft\Windows\Start Menu\Programs\Startup` on a compromised host in order to maintain persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Dark Caracal's version of Bandook adds a registry key to `HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run` for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Darkhotel has been known to establish persistence by adding programs to the Run Registry key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Dragonfly has added the registry value ntdll to the Registry Run key to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
FIN10 has established persistence by using the Registry option in PowerShell Empire to add a Run key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
FIN13 has used Windows Registry run keys such as, `HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hosts` to maintain persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
FIN6 has used Registry Run keys to establish persistence for its downloader tools known as HARDTACK and SHIPBREAD.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Gamaredon Group tools have registered Run keys in the registry to give malicious VBS files persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Higaisa added a spoofed binary to the start-up folder for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Inception has maintained persistence by modifying Registry run key value 
 `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\`.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Several Ke3chang backdoors achieved persistence by adding a Run key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Kimsuky has placed scripts in the startup folder for persistence and modified the `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce` Registry key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Lazarus Group has maintained persistence by loading malicious code into a startup folder or by adding a Registry Run key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
LazyScripter has achieved persistence via writing a PowerShell script to the autorun registry key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
LuminousMoth has used malicious DLLs that setup persistence in the Registry Key `HKCU\Software\Microsoft\Windows\Current Version\Run`.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Magic Hound malware has used Registry Run keys to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Molerats saved malicious files within the AppData and Startup folders to maintain persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
MuddyWater has added Registry Run key `KCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemTextEncoding` to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Mustang Panda has created the registry key `HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobelmdyU` to maintain persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Naikon has modified a victim's Windows Run registry to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
PROMETHIUM has used Registry run keys to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Patchwork has added the path of its second-stage malware to the startup folder to achieve persistence. One of its file stealers has also persisted by adding a Registry Run key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
A dropper used by Putter Panda installs itself into the ASEP Registry key `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` with a value named McUpdate.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
RTM has used Registry run keys to establish persistence for the RTM Trojan and other tools, such as a modified version of TeamViewer remote desktop software.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Sidewinder has added paths to executables in the Registry to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Silence has used `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`, `HKLM\Software\Microsoft\Windows\CurrentVersion\Run`, and the Startup folder to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
TA2541 has placed VBS files in the Startup folder and used Registry run keys to establish persistence for malicious payloads.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
TeamTNT has added batch scripts to the startup folder.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Threat Group-3390's malware can add a Registry key to `Software\Microsoft\Windows\CurrentVersion\Run` for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Tropic Trooper has created shortcuts in the Startup folder to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
A Turla Javascript backdoor added a local_update_check value under the Registry key `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` to establish persistence. Additionally, a Turla custom executable containing Metasploit shellcode is saved to the Startup folder to gain persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Windshift has created LNK files in the Startup folder to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Wizard Spider has established persistence via the Registry key `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` and a shortcut within the startup folder.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
ZIRCONIUM has created a Registry Run key named `Dropbox Update Setup` to establish persistence for a malicious Python binary.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
ADVSTORESHELL achieves persistence by adding itself to the `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` Registry key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
ANDROMEDA can establish persistence by dropping a sample of itself to `C:\ProgramData\Local Settings\Temp\mskmde.com` and adding a Registry run key to execute every time a user logs on.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Agent Tesla can add itself to the Registry as a startup program to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Amadey has changed the Startup folder to the one containing its executable by overwriting the registry keys.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
AppleSeed has the ability to create the Registry key name `EstsoftAutoUpdate` at `HKCU\Software\Microsoft/Windows\CurrentVersion\RunOnce` to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Aria-body has established persistence via the Startup folder or Run Registry key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Astaroth creates a startup item for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
AuTo Stealer can place malicious executables in a victim's AutoRun registry key or StartUp directory, depending on the AV product installed, to maintain persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Avaddon uses registry run keys for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
AvosLocker has been executed via the `RunOnce` Registry key to run itself on safe mode.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
BACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
BADNEWS installs a registry Run key to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
BBSRAT has been loaded through DLL side-loading of a legitimate Citrix executable that is set to persist through the Registry Run key location `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ssonsvr.exe`.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
BabyShark has added a Registry key to ensure all future macros are enabled for Microsoft Word and Excel as well as for additional persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Backdoor.Oldrea adds Registry Run keys to achieve persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
BadPatch establishes a foothold by adding a link to the malware executable in the startup folder.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Bazar can create or add files to Registry Run Keys to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Bisonal has added itself to the Registry key `HKEY_CURRENT_USER\Software\Microsoft\CurrentVersion\Run\` for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
BitPaymer has set the run key `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
The BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
BoomBox can establish persistence by writing the Registry value `MicroNativeCacheSvc` to `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Briba creates run key Registry entries pointing to malicious DLLs dropped to disk.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
CORESHELL has established persistence by creating autostart extensibility point (ASEP) Registry entries in the Run key and other Registry keys, as well as by creating shortcuts in the Internet Explorer Quick Start folder.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Carbanak stores a configuration files in the startup directory to automatically execute commands in order to persist across reboots.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Carberp has maintained persistence by placing itself inside the current user's startup folder.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Cardinal RAT establishes Persistence by setting the  `HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load` Registry key to point to its executable.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
ChChes establishes persistence by adding a Registry Run key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Chaes has added persistence via the Registry key `software\microsoft\windows\currentversion\run\microsoft windows html help`.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Chinoxy has established persistence via the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` registry key and by loading a dropper to `(%COMMON_ STARTUP%\\eoffice.exe)`.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Clambling can establish persistence by adding a Registry run key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Cobian RAT creates an autostart Registry key to ensure persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Comnie achieves persistence by adding a shortcut of itself to the startup path in the Registry.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Conficker adds Registry Run keys to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
One persistence mechanism used by CozyCar is to set itself to be executed at system startup by adding a Registry value under one of the following Registry keys: <br>`HKLM\Software\Microsoft\Windows\CurrentVersion\Run\` <br>`HKCU\Software\Microsoft\Windows\CurrentVersion\Run\` <br>`HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run` <br>`HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run`
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Crimson can add Registry run keys for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
CrossRAT uses run keys for persistence on Windows.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
DarkComet adds several Registry entries to enable automatic execution at every system startup.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
DarkGate installation includes AutoIt script execution creating a shortcut to itself as an LNK object, such as bill.lnk, in the victim startup folder. DarkGate installation finishes with the creation of a registry Run key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
DarkTortilla has established persistence via the `Software\Microsoft\Windows NT\CurrentVersion\Run` registry key and by creating a .lnk shortcut file in the Windows startup folder.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
DnsSystem can write itself to the Startup folder to gain persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
DownPaper uses PowerShell to add a Registry Run key in order to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
DustySky achieves persistence by creating a Registry entry in `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run`.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
EVILNUM can achieve persistence through the Registry Run key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
If establishing persistence by installation as a new service fails, one variant of Elise establishes persistence for the created .exe file by setting the following Registry key: `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\svchost : %APPDATA%\Microsoft\Network\svchost.exe`. Other variants have set the following Registry keys for persistence: `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\imejp : [self]` and `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IAStorD`.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Variants of Emissary have added Run Registry keys to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Emotet has been observed adding the downloaded payload to the `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run` key to maintain persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Empire can modify the registry run keys `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run` and `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run` for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
EvilBunny has created Registry keys for persistence in `[HKLM|HKCU]\…\CurrentVersion\Run`.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
EvilGrab adds a Registry Run key for ctfmon.exe to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
FELIXROOT adds a shortcut file to the startup folder for persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
FLASHFLOOD achieves persistence by making an entry in the Registry's Run key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
FatDuke has used `HKLM\SOFTWARE\Microsoft\CurrentVersion\Run` to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
FinFisher establishes persistence by creating the Registry key `HKCU\Software\Microsoft\Windows\Run`.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Final1stspy creates a Registry Run key to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Flagpro has dropped an executable file to the startup directory.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
FlawedAmmyy has established persistence via the `HKCU\SOFTWARE\microsoft\windows\currentversion\run` registry key.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
FunnyDream can use a Registry Run Key and the Startup folder to establish persistence.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
GRIFFON has used a persistence module that stores the implant inside the Registry, which executes at logon.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation
Gazer can establish persistence by creating a .lnk file in the Start menu.
Technique: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Tactic: TA0003 Persistence TA0004 Privilege Escalation