Registry Run Keys / Startup Folder (T1060)

View on ATT&CK

In Playbook

Technique & Subtechniques

  • Registry Run Keys / Startup Folder

Associated Tactics

  • Persistence

Persistence (TA0003)

The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.

View on ATT&CK

Procedure Examples

Description Source(s)
capec
Microsoft. (n.d.). Run and RunOnce Registry Keys. Retrieved November 12, 2014. Microsoft Run Key
Microsoft. (2018, August 20). Description of the RunOnceEx Registry Key. Retrieved June 29, 2018. Microsoft RunOnceEx APR 2018
Moe, O. (2018, March 21). Persistence using RunOnceEx - Hidden from Autoruns.exe. Retrieved June 29, 2018. Oddvar Moe RunOnceEx Mar 2018
Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016. TechNet Autoruns