Log in Request a demo

Attack technique

Boot or Logon Autostart Execution

Boot or logon autostart execution is when an attacker sets up a computer so that their program starts by itself when the system boots or a user logs on.

In short

Boot or logon autostart execution is when an attacker sets up a computer so that their program starts by itself when the system boots or a user logs on. This lets the attacker stay on the system after a restart. Some of these startup items run with higher privileges, so it can also help the attacker gain more control.

Last updated 8 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact
  1. MITRE IDT1547ATT&CK technique
  2. Detection4ways to spot itDetection strategy MITRE lists
  3. Defences2ways to stop itInvest in detection

How it works

Operating systems have built-in ways to run programs automatically at boot or logon. Some use special folders. Others use settings stored in configuration databases, such as the Windows Registry.

An attacker who has access to a system can add their own program to one of these places. The program then starts again every time the system boots or the user logs on, even after a restart.

An attacker can also change or extend parts of the operating system kernel to get the same result. Because some startup programs run with higher privileges, this can also be used to gain higher-level access.

The technique covers Windows, macOS, Linux and network devices. MITRE lists 14 sub-techniques that cover the different mechanisms.

MITRE lists 14 sub-techniques: T1547.001 Registry Run Keys / Startup Folder; T1547.002 Authentication Package; T1547.003 Time Providers; T1547.004 Winlogon Helper DLL; T1547.005 Security Support Provider; T1547.006 Kernel Modules and Extensions; T1547.007 Re-opened Applications; T1547.008 LSASS Driver; T1547.009 Shortcut Modification; T1547.010 Port Monitors; T1547.012 Print Processors; T1547.013 XDG Autostart Entries; T1547.014 Active Setup; T1547.015 Login Items.

A real example

Procedure examples listed by MITRE ATT&CK:

  • BoxCaon set a Windows registry key (the Windows load value) to point to its executable, which gives it persistence.
  • xCaon added persistence through the same kind of registry key, so the malware runs each time any user logs in.
  • Dtrack's remote access tool creates a persistent target file that runs automatically when the host starts.
  • Mis-Type created registry keys for persistence, including Active Setup keys.
  • APT42 is listed by MITRE ATT&CK as having modified the Registry to maintain persistence.

How to detect

  1. Watch startup settings for changes

    Look for new or changed entries in the places that start programs at boot or logon, such as Windows Registry autostart settings. Compare them with abnormal parent and child process patterns at logon or startup.

  2. Watch service and init files on Linux

    Look for new or changed service definition files and boot scripts, and for unusual process behavior during boot.

  3. Watch launch configuration files on macOS

    Look for new or changed launch agent and launch daemon configuration files, followed by unusual programs running after a user logs on.

  4. Detection strategy MITRE lists

    DET0274, Boot or Logon Autostart Execution Detection Strategy.

How to defend

  1. Accept that prevention is limited

    MITRE notes this technique is hard to stop with preventive controls, because it abuses normal system features.

  2. Invest in detection

    Because blocking is hard, monitor autostart locations and startup behavior so unexpected changes are noticed quickly.

Questions

What is Boot or Logon Autostart Execution (T1547)?

It is a technique where an attacker sets up a computer so their program starts by itself when the system boots or a user logs on. It lets the attacker stay on the system after a restart, and some startup items run with higher privileges.

Which systems does this technique cover?

MITRE says it covers Windows, macOS, Linux and network devices. It lists 14 sub-techniques that cover the different mechanisms, including special folders and settings stored in configuration databases such as the Windows Registry.

How can I detect Boot or Logon Autostart Execution?

Look for new or changed entries in the places that start programs at boot or logon, such as Windows Registry autostart settings. On Linux watch service definition files and boot scripts, and on macOS watch launch agent and launch daemon configuration files.

Can Boot or Logon Autostart Execution be prevented?

Only to a limited degree. MITRE notes this technique is hard to stop with preventive controls because it abuses normal system features. Because blocking is hard, monitor autostart locations and startup behavior so unexpected changes are noticed quickly.

In our research

  1. GRU targeting of logistics firms: advisory AA25-141A October 2026
  2. ATT&CK techniques most used across threat groups October 2026
  3. Konni (Vedalia / TA406 / Opal Sleet): North Korea’s Steady Hand in Espionage Operations March 2026
  4. APT33/Peach Sandstorm: Threat Forecast and Analysis of a Cloud-Focused Adversary November 2025
  5. UNC1549 MINIBUS Backdoor Technical Analysis March 2025
  6. KageNoHitobito Ransomware Technical Analysis August 2024

Sources

  1. MITRE ATT&CK T1547: Boot or Logon Autostart Execution MITRE
  2. MITRE ATT&CK Persistence (TA0003) MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

APT18

APT18 (MITRE G0026) is described by MITRE ATT&CK as a threat group active since at least 2009, with targets in technology, manufacturing, government and medical sectors. A US health sector briefing (HHS HC3, 2020) lists suspected attribution to China; no advisory, indictment or named sponsor was found.

Read more

Threat group

APT19

MITRE ATT&CK describes APT19 (also Codoso) as a Chinese-based group that has targeted defense, finance, legal and other industries, with activity reported in 2014 and 2017. Only MITRE ATT&CK documents this group, no government advisory names it, and MITRE says it is unclear whether APT19 and Deep Panda are the same group.

Read more