← Threat archive

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

2 threats tracked by Spectrum Delta use this technique.

T1547.001 on MITRE ATT&CK →

  • Sirius backdoor FedEx fileless

    Persistence matrix incl. OS-reset survival

    EID 4698/EID 1 (schtasks), EID 11 (.ppkg, SetupComplete.cmd, logon.cmd, updater.vbs, .lnk, svchost.exe drops), EID 12/13 + 4657 (Run key, HKCU\Environment value, BootExecute, AppCompatFlags)

    Seen in: Windows scheduled task, Windows registry, Windows file creation

  • MythicRatatoskr Yggdrasil C2

    Run-key persistence for MATCHWOK

    Sysmon EID 13 (registry value set) on Run keys; Security 4657; reg.exe process telemetry as an alternative mechanism signal

    Seen in: Sysmon / EDR