Home/ MITRE Matrix/ Persistence/ T1547.014

T1547.014Active Setup

T1547.014 — Active Setup is a MITRE ATT&CK technique in the Persistence tactic. Clankerusecase tracks 3 detection use cases covering it and 1 threat-intel article citing it.

PersistencePrivilege Escalation

View on the matrix → Filter Detection Library MITRE official spec ↗

3Use cases

1Articles

0Sub-techniques

2Tactics

↑ Parent technique: T1547 · Boot or Logon Autostart Execution

Use cases covering this technique (3)

Active Setup Registry Autostart ESCU actions · alerting P Windows Audit Policy Auditing Option Modified - Registry ESCU actions · hunting P [LLM] termsrv.dll patched (multi-RDP enabling) - takeown + binary write + TermService restart Bespoke install · alerting DSΣPDDCS

Articles citing this technique (1)

crit Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payload art-219