Active Setup is a Windows mechanism that runs programs when a user logs in. MITRE tracks its abuse as T1547.014, under Boot or Logon Autostart Execution, with Persistence and Privilege Escalation as the tactics.
How attackers use it
An adversary creates a key under HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\ and sets a malicious StubPath value. That value is the program executed when a user logs into the computer.
The program runs in the context of the user and carries that account's permissions. MITRE notes it can be used to keep remote access tools alive across reboots, and that adversaries may use Masquerading so the key looks like it belongs to a legitimate program.
How to detect it
MITRE's detection strategy is a multi-event correlation:
- A new or changed Active Setup key with a non-standard
StubPath. - Followed by process execution from an uncommon path, an unsigned binary, or an odd parent and child relationship after logon.
Registry auditing on that key, plus process creation logging with command lines, gives you both halves.
How to reduce the risk
MITRE says this technique cannot be easily mitigated with preventive controls, since it abuses a system feature. Practical steps follow from that: restrict who can write under HKLM, keep a baseline of the components your software installs, and alert on new entries.
Quick check
Which value in an Active Setup component decides what runs at logon?
StubPath.
Sources
- MITRE ATT&CK, Boot or Logon Autostart Execution: Active Setup: https://attack.mitre.org/techniques/T1547/014
