Log in Request a demo

Attack technique

Registry Run Keys / Startup Folder

Windows can start programs on its own when a user logs in.

In short

Windows can start programs on its own when a user logs in. Attackers add their own program to the places that control this, the Registry run keys or the Startup folder. The program then starts again after every restart or logon.

Last updated 8 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact
  1. MITRE IDT1547.001ATT&CK technique
  2. Detection4ways to spot itChanges to Run keys · Unusual paths and scripts
  3. Defences2ways to stop itPrevention is limited · Focus on monitoring

How it works

Windows has set places where it looks for programs to launch at logon. These include certain Registry run keys and the Startup folders.

An attacker adds an entry to one of these places that points to their own program. When the user next logs in, Windows starts it with that user’s permission level.

This is a normal operating system feature, so the attacker does not need any special tool to use it. MITRE places it under persistence and privilege escalation, as part of the wider group of boot or logon autostart methods.

A real example

  • MITRE ATT&CK lists ADVSTORESHELL as keeping itself running by adding itself to a Registry Run key.
  • MITRE ATT&CK lists Agent Tesla as adding itself to the Registry as a startup program for persistence.
  • MITRE ATT&CK lists Amadey as changing the Startup folder to the one holding its executable by overwriting Registry keys.
  • MITRE ATT&CK lists APT3 as placing scripts in the startup folder for persistence.
  • MITRE ATT&CK lists APT29 as adding Registry Run keys to establish persistence.

How to detect

  1. Changes to Run keys

    Monitor the creation and change of Registry entries in the Run and startup locations.

  2. Unusual paths and scripts

    Pay extra attention when a new entry points to an odd file location or to a script instead of a normal installed program.

  3. What runs next

    Link the change to the process that follows. Programs started from non-standard folders, or with strange parent and child relationships, deserve a closer look.

  4. Data sources MITRE lists

    File Creation, Process Creation, Windows Registry Key Modification

How to defend

  1. Prevention is limited

    MITRE states that this technique cannot be easily stopped with preventive controls, because it abuses normal system features.

  2. Focus on monitoring

    Since blocking is hard, the practical defense is to watch the startup locations and review new entries, as described above.

Questions

What are Registry Run keys and the Startup folder?

They are set places where Windows looks for programs to launch at logon. Attackers add an entry that points to their own program, which then starts when the user next logs in.

Why do attackers use Run keys for persistence?

It is a normal operating system feature, so the attacker needs no special tool. The program starts again after every restart or logon with that user's permission level.

How can I detect Run key abuse?

Monitor creation and change of Registry entries in the Run and startup locations. Pay extra attention to entries pointing to odd file locations or scripts, and link the change to the process that follows.

Can this technique be blocked?

MITRE states it cannot be easily stopped with preventive controls because it abuses normal system features. The practical defense is to watch the startup locations and review new entries.

In our research

  1. GRU targeting of logistics firms: advisory AA25-141A October 2026
  2. ATT&CK techniques most used across threat groups October 2026
  3. Konni (Vedalia / TA406 / Opal Sleet): North Korea’s Steady Hand in Espionage Operations March 2026
  4. APT27 January 2026
  5. FIN11 (DEV-0950 / Lace Tempest / TA505 / TEMP.Warlock / UNC902): A 1000-Word Intelligence January 2026
  6. APT40 January 2026

Sources

  1. MITRE ATT&CK T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder MITRE
  2. MITRE ATT&CK T1547: Boot or Logon Autostart Execution MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

APT18

APT18 (MITRE G0026) is described by MITRE ATT&CK as a threat group active since at least 2009, with targets in technology, manufacturing, government and medical sectors. A US health sector briefing (HHS HC3, 2020) lists suspected attribution to China; no advisory, indictment or named sponsor was found.

Read more

Threat group

APT19

MITRE ATT&CK describes APT19 (also Codoso) as a Chinese-based group that has targeted defense, finance, legal and other industries, with activity reported in 2014 and 2017. Only MITRE ATT&CK documents this group, no government advisory names it, and MITRE says it is unclear whether APT19 and Deep Panda are the same group.

Read more