T1547.001 in MITRE ATT&CK: Registry Run Keys and Startup Folder Explained

Summary

The article describes how attackers abuse Windows Registry Run Keys and the Startup Folder to maintain persistence on compromised systems. It outlines the key registry paths and file system locations that adversaries commonly target. Real-world examples include the CABINETRAT malware and an AdaptixC2 beacon. This activity is tracked as T1547.001, a persistence sub-technique in the MITRE ATT&CK framework.

Investigation

Researchers at Picus Security documented a CABINETRAT campaign in October 2025 that created a Run key to launch cmd.exe. In a separate September 2025 case, analysts observed a PowerShell script copying a payload into AppData and creating a shortcut in the Startup Folder for the AdaptixC2 framework. Both cases illustrate how Run keys and Startup shortcuts remain effective persistence methods in real-world attacks.

Mitigation

Defenders should continuously monitor for creation or modification of well-known Run keys and Startup Folder paths. Organizations should enable protected registry auditing, apply least-privilege controls to user accounts, and use application control to block unauthorized scripts and shortcut files from being written to these locations.

Response

When suspicious Run key or Startup Folder activity is identified, isolate the affected endpoint, collect the altered registry values and linked files, and begin forensic analysis. Remove the malicious persistence entries, stop the related processes, and reset any compromised credentials. Detection rules should then be updated to capture the observed indicators.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (T1547.001) designed to trigger the detection rule. The commands and narrative directly reflect the TTP and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An adversary who has obtained administrative rights on the target host wants persistent execution of a malicious payload (C:Tempevil.exe). To remain stealthy, they choose a classic “living‑off‑the‑land” method: writing the payload path to the HKLMSoftwareMicrosoftWindowsCurrentVersionRun key. This guarantees execution every time the system boots, and because the key is a well‑known autostart location, it aligns perfectly with the detection rule’s focus.

  1. Create the malicious executable (simulated with a simple copy of cmd.exe).
  2. Add a new string value named EvilApp pointing to the malicious executable.
  3. Verify the registry entry exists (generates the write event).

• Regression Test Script:

  # -------------------------------------------------
  # Simulate T1547.001 – Registry Run Keys persistence
  # -------------------------------------------------
  $payloadPath = "C:Tempevil.exe"
  
  # 1. Deploy a harmless stand‑in payload (copy cmd.exe)
  New-Item -ItemType Directory -Path "C:Temp" -Force | Out-Null
  Copy-Item -Path "$env:windirSystem32cmd.exe" -Destination $payloadPath -Force
  
  # 2. Write the malicious Run key (HKLM)
  $runKey = "HKLM:SoftwareMicrosoftWindowsCurrentVersionRun"
  New-ItemProperty -Path $runKey -Name "EvilApp" -Value $payloadPath -PropertyType String -Force
  
  # 3. Output confirmation (optional)
  Write-Host "Malicious Run key created:" -ForegroundColor Yellow
  Get-ItemProperty -Path $runKey -Name "EvilApp"
  # -------------------------------------------------
  # End of simulation script
  # -------------------------------------------------

• Cleanup Commands:

  # -------------------------------------------------
  # Remove the simulated persistence artefacts
  # -------------------------------------------------
  $runKey = "HKLM:SoftwareMicrosoftWindowsCurrentVersionRun"
  Remove-ItemProperty -Path $runKey -Name "EvilApp" -ErrorAction SilentlyContinue
  
  Remove-Item -Path "C:Tempevil.exe" -Force -ErrorAction SilentlyContinue
  # -------------------------------------------------
  # End of cleanup
  # -------------------------------------------------