T1547.014 — Active Setup

Tactics: Persistence, Privilege Escalation · Platforms: Windows

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine. Active Setup is a Windows mechanism that is used to execute programs when a user logs in. The value stored in the Registry key will be executed after a user logs into the computer. These programs…

Sub-technique of Boot or Logon Autostart Execution (T1547).

Sigma detection rules (1)

T1547.014 Boot or Logon Autostart Execution: Active Setup

title: "T1547.014 Boot or Logon Autostart Execution: Active Setup"
id: 9d841a98-69eb-4dd8-bcdd-5341d919e233
description: 'Detect Active Setup Persistence via StubPath Execution. (Retargeted from the original process_creation label to registry_set — this is the telemetry source that actually captures this technique''s behavior; see logsource below.) Tune using: TimeWindow, ParentProcessName, StubPathValueEntropy, SignedBinaryStatus, RegistryKeyOwner.'
references:
  - https://attack.mitre.org/techniques/T1547/014
author: Shahrukh Khan
date: 2026-01-28
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1547.014

logsource:
  category: registry_set
  product: windows
  service: sysmon

detection:
  selection:
    TargetObject|contains: '\Active Setup\Installed Components\'
    TargetObject|endswith: '\StubPath'

  condition: selection

falsepositives:
  - Legitimate software installers register Active Setup stub-path entries for per-user first-run configuration; verify the referenced binary's signature and path.

level: high

Related sub-techniques

Explore