Detecting and Mitigating Registry Run Keys and Startup Folders (T1547.001)

Registry Run Keys and Startup Folder abuse (MITRE ATT&CK T1547.001) is one of the best known Windows persistence techniques. A program added to a startup folder, or referenced by a registry run key, runs when a user logs in. It runs in the context of that user and has that account's permissions.

It is common because it is easy, and it is easy to check for the same reason. A good baseline makes most abuse stand out.

How attackers use it

MITRE lists the run keys created by default on Windows:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

Run keys can exist under multiple hives. RunOnceEx is also available under HKLM, though it is not created by default on Windows Vista and newer. Entries can name a program directly or list it as a dependency. MITRE gives the example of loading a DLL at logon through a Depend key under RunOnceEx.

Startup folders work the same way. There is one for each user account and one system wide. The current user's folder is C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, and the all users folder is C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp. The system wide folder is checked no matter which account logs in.

Less familiar locations also appear in MITRE's description:

• RunServices and RunServicesOnce, under both HKLM and HKCU, which control automatic startup of services during boot.
• The policy keys Policies\Explorer\Run, under HKLM and HKCU, which hold values created when startup programs are set through policy settings.
• The load value of HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows, whose programs run automatically for the logged-on user.
• The BootExecute multistring value of HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager. By default it is autocheck autochk *, which checks file system integrity after an abnormal shutdown. Adversaries can add other programs to this value so they launch at boot.

Adversaries use these locations to run malware such as remote access tools and keep it across reboots. They may also use Masquerading so entries look related to legitimate programs.

How to detect it

MITRE's strategy for Windows is a multi-event correlation:

• Registry key creation or modification under the known Run and startup keys.
• New or unusual binary paths, or script based payloads.
• Execution from non-standard directories, or abnormal parent and child process relationships.

Sysmon event IDs 12 and 13 capture registry writes, and event ID 11 captures files created in startup folders. A realistic filter is to alert on any new Run value whose path is outside C:\Program Files, C:\Program Files (x86) or C:\Windows, or which starts a script host.

Do not forget BootExecute. Because it normally holds one default value, any other content is high signal.

How to reduce the risk

MITRE lists no mitigations for this sub-technique. The controls that fit:

1. Application control. Block or alert on execution from user writable locations.
2. Registry and folder permissions. Limit who can write to HKLM run keys and the all users Startup folder.
3. Least privilege. User level run keys run with that user's rights, so reducing local administrator rights limits the effect.
4. Managed baselines. Compare the keys and folders against the expected set on each standard build.

Check your own environment

Read-only commands. Use a Windows command prompt and PowerShell:

reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
reg query "HKLM\System\CurrentControlSet\Control\Session Manager" /v BootExecute
dir "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup"
dir "%ProgramData%\Microsoft\Windows\Start Menu\Programs\StartUp"

For each entry that appears, work through this list:

1. Does the program belong to software you know?
2. Is it stored in a protected folder and signed?
3. Is the name a close copy of a Windows or vendor component?
4. Does the same entry exist on other machines of this build?
5. Does BootExecute hold only the default value?

Quick check

Sources

• MITRE ATT&CK T1547.001, Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder