T1547
Boot or Logon Autostart Execution
Also appears in: Persistence
Index entry
In-depth coverage of this technique (how it looks in telemetry, how to hunt it, and how to rule out benign activity) is coming soon. It's in our catalog and on the roadmap to be written up.
Telemetry needed
The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.
- Linux audit framework (auditd)
- SYSCALL:creat SYSCALL record for creat
- SYSCALL:write SYSCALL record for write
- macOS unified log (the log as a whole)
- Windows Security event log
- 4688 A new process has been created.
- Sysmon
Practice it
1 scenario in this catalog covers T1547. We don't name it, because identifying the technique is part of what a scenario grades. Explore the Range →