T1547.001 — Registry Run Keys / Startup Folder

Tactics: Persistence, Privilege Escalation · Platforms: Windows

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the…

Sub-technique of Boot or Logon Autostart Execution (T1547).

Sigma detection rules (1)

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder - Run Key Set

title: "T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder - Run Key Set"
id: 2b5ed31a-f30e-403e-bf29-0ac699880a01
status: test
description: 'Detects a value being set under the classic Run/RunOnce autostart registry keys.'
references:
  - https://attack.mitre.org/techniques/T1547/001/
author: Shahrukh Khan
date: 2026-07-10
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1547.001

logsource:
  category: registry_set
  product: windows
  service: sysmon

detection:
  selection:
    TargetObject|contains:
      - '\Software\Microsoft\Windows\CurrentVersion\Run'
      - '\Software\Microsoft\Windows\CurrentVersion\RunOnce'

  condition: selection

falsepositives:
  - Many legitimate applications register themselves under Run/RunOnce at install time — tune by vendor path

level: medium

Related sub-techniques

Explore