T1547Boot or Logon Autostart Execution
T1547 — Boot or Logon Autostart Execution is a MITRE ATT&CK technique in the Persistence tactic. Clankerusecase tracks 4 detection use cases covering it and 3 threat-intel articles citing it.
PersistencePrivilege Escalation
4Use cases
3Articles
14Sub-techniques
2Tactics
Sub-techniques (14)
T1547.014 · Active SetupT1547.002 · Authentication PackageT1547.006 · Kernel Modules and ExtensionsT1547.015 · Login ItemsT1547.008 · LSASS DriverT1547.010 · Port MonitorsT1547.012 · Print ProcessorsT1547.007 · Re-opened ApplicationsT1547.001 · Registry Run Keys / Startup FolderT1547.005 · Security Support ProviderT1547.009 · Shortcut ModificationT1547.003 · Time ProvidersT1547.004 · Winlogon Helper DLLT1547.013 · XDG Autostart Entries