Boot or Logon Autostart Execution
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
Every observable in this brief is owned by a more specific technique, and what MITRE says makes it parent-level is a correlation this Sigma subset cannot express. AN0764 (Windows) is registry modification of Run/RunOnce, which is exactly T1547.001 — that technique still holds an unauthored brief in this corpus, so writing the rule here would file a child's detection under the parent tag and block the child from ever getting it. AN0764's second half (Security 4688) is process creation at logon, and a 4688 record carries no field saying a process was launched by an autostart entry, so the Run-key half is all that is left; the analytic then asks for that registry write to be correlated with 'abnormal parent-child process relationships and outlier execution at user logon or system startup', which needs a cross-event join plus a per-host baseline, and lib/sigma models no timeframe, no aggrega […]
Covered instead by T1547.001, T1547.006, T1547.013, T1547.015, T1543.001, T1543.002, T1037.004.
What the technique is
Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon. These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel. Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0764
Correlation of registry key modification for Run/RunOnce with abnormal parent-child process relationships and outlier execution at user logon or system startup
- AN0765
Correlates creation/modification of systemd service files or /etc/init.d scripts with outlier process behavior during boot
- AN0766
Observes creation or modification of LaunchAgent/LaunchDaemon property list files combined with anomalous plist payload execution after user logon
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.