Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Persistence/ T1547.001

T1547.001Registry Run Keys / Startup Folder

T1547.001 — Registry Run Keys / Startup Folder is a MITRE ATT&CK technique in the Persistence tactic. Clankerusecase tracks 39 detection use cases covering it and 23 threat-intel articles citing it.

PersistencePrivilege Escalation
View on the matrix → Filter Detection Library MITRE official spec ↗
39Use cases
23Articles
0Sub-techniques
2Tactics
↑ Parent technique: T1547 · Boot or Logon Autostart Execution

Use cases covering this technique (39)

Registry Keys Used For Persistence ESCU actions · alerting P Windows Boot or Logon Autostart Execution In Startup Folder ESCU actions · hunting P Windows NorthStar C2 Agent Execution ESCU actions · alerting P Windows PowerShell MSIX Package Installation ESCU actions · alerting P Windows Registry BootExecute Modification ESCU actions · alerting P Windows Registry Modification for Safe Mode Persistence ESCU actions · alerting P Article-specific behavioural hunt — Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware Bespoke exploit · hunting DSP [LLM] Cruciferra persistence: Run key 'putty' value pointing to non-PuTTY binary Bespoke install · alerting DSΣPDDCS Article-specific behavioural hunt — UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially Bespoke exploit · hunting DSP Article-specific behavioural hunt — Unpacking the AsyncAPI npm supply chain compromise and import-time payload deliv Bespoke exploit · hunting DSP [LLM] axios RAT persistence: HKCU Run value MicrosoftUpdate pointing to system.bat Bespoke install · alerting DSΣPDDCS Article-specific behavioural hunt — Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation Bespoke exploit · hunting DSP [LLM] Gamaredon WinRAR CVE-2025-8088 ADS path-traversal dropping HTA/VBS into Startup folder Bespoke install · alerting DSΣPDDCS [LLM] Gamaredon HTA downloader auto-executing from Startup folder at logon (mshta.exe) Bespoke exploit · alerting DSΣPDDCS [LLM] easy-day-js Windows persistence: Run key 'NvmProtocal' / protocal.cjs autostart Bespoke install · alerting DSΣPDDCS [LLM] easy-day-js implant artifacts dropped: protocal.cjs / NodePackages / cross-OS persistence files Bespoke install · alerting DSΣPDDCS Article-specific behavioural hunt — ESET takes part in Operation Endgame to disrupt Amadey and Stealc Bespoke exploit · hunting DSP Article-specific behavioural hunt — ESET takes part in Operation Endgame to disrupt Amadey and Stealc Bespoke exploit · hunting DSP [LLM] axios RAT Windows persistence: %PROGRAMDATA%\wt.exe drop + %TEMP%\6202033.vbs/.ps1 staging Bespoke install · alerting DSΣPDDCS Article-specific behavioural hunt — Webworm: New burrowing techniques Bespoke exploit · hunting DSP Article-specific behavioural hunt — Webworm: New burrowing techniques Bespoke exploit · hunting DSP Article-specific behavioural hunt — FrostyNeighbor: Fresh mischief and digital shenanigans Bespoke exploit · hunting DSP Article-specific behavioural hunt — FrostyNeighbor: Fresh mischief and digital shenanigans Bespoke exploit · hunting DSP [LLM] IoliteLabs Stage-2 regsvr32 LOLbin loading ntuser DLL from fake Chrome\ChromeUpdate path Bespoke install · alerting DSΣPDD Article-specific behavioural hunt — TeamPCP Plants WAV Steganography Credential Stealer in telnyx PyPI Package Bespoke exploit · hunting DSP [LLM] msbuild.exe dropped to Startup folder (TeamPCP telnyx Windows persistence) Bespoke install · alerting DSΣPDDCS Article-specific behavioural hunt — Popular telnyx package compromised on PyPI by TeamPCP Bespoke exploit · hunting DSP [LLM] TeamPCP msbuild.exe persistence in user Startup folder Bespoke install · alerting DSΣPDDCS [LLM] ValleyRAT registry-resident shellcode (HKCU\Console\0|1) and MyPythonApp Run-key persistence Bespoke install · hunting DSΣP Article-specific behavioural hunt — GlassWorm Hides a RAT Inside a Malicious Chrome Extension Bespoke exploit · hunting DSP [LLM] GlassWorm Stage-3 RAT installation under %APPDATA%\QtCvyfVWKH\index.js Bespoke install · alerting DSΣPDDCS [LLM] GlassWorm Stage-3a UpdateLedger Run-key persistence pointing at %TEMP%\SKuyzYcDD.exe Bespoke install · alerting DSΣPDDCS [LLM] Glassworm stage-3 persistence: schtasks UpdateApp + HKCU Run DPKCbbQ Bespoke install · alerting DSΣPDD [LLM] DRILLAPP variant 1 persistence: LNK file written to user Startup folder by non-Explorer process Bespoke install · alerting DSΣPDDCS [LLM] PlugX persistence — Run key 'G DATA' pointing to C:\Users\Public\GDatas\Avk.exe Bespoke install · alerting DSΣPDD [LLM] MuddyViper persistence via ManageOnDriveUpdater scheduled task or Startup folder hijack Bespoke install · alerting DSPDDCS [LLM] WinRAR CVE-2025-8088 path traversal — payload dropped to user Startup folder Bespoke install · alerting DSΣPDDCS [LLM] Archive utility writing LNK/DLL/EXE to Windows Startup folder (RomCom CVE-2025-8088) Bespoke install · alerting DSΣP [LLM] Zip Slip arbitrary file overwrite by archive-handling runtime (java/python) via path traversal Bespoke exploit · hunting DSΣPDDCS

Articles citing this technique (23)

crit Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware art-65
crit UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign art-156
high Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery art-157
crit What is a dependency firewall? art-192
crit Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation art-223
high Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances art-294
high Everybody's shipping code they can't read art-295
crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-301
crit ESET APT Activity Report Q4 2025–Q1 2026 art-387
crit Webworm: New burrowing techniques art-413
crit FrostyNeighbor: Fresh mischief and digital shenanigans art-435
high Malicious IoliteLabs VSCode Extensions Target Solidity Developers on Windows, macOS, and Linux with Backdoor art-534
crit TeamPCP Plants WAV Steganography Credential Stealer in telnyx PyPI Package art-535
crit Popular telnyx package compromised on PyPI by TeamPCP art-547
high A cunning predator: How Silver Fox preys on Japanese firms this tax season art-548
crit GlassWorm Hides a RAT Inside a Malicious Chrome Extension art-580
high Glassworm Strikes Popular React Native Phone Number Packages art-587
high DRILLAPP: new backdoor targeting Ukrainian entities with possible links to Laundry Bear art-590
crit PlugX Meeting Invitation via MSBuild and GDATA art-615
med MuddyWater: Snakes by the riverbank art-756
crit The who, where, and how of APT attacks in Q2 2025–Q3 2025 art-792
crit ESET APT Activity Report Q2 2025–Q3 2025 art-793
crit Behind the disclosure: the Zip Slip vulnerability art-3599