菜单
Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill t1547-boot-or-logon-autostart-execution命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
正在显示 SKILL.md
基于 SOC 职业分类
| name | T1547_boot-or-logon-autostart-execution |
| description | Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. |
| category | configuration |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1547","persistence","privilege-escalation","linux","macos","windows","network-devices"] |
| technique_id | T1547 |
| tactic | persistence |
| all_tactics | ["persistence","privilege-escalation"] |
| platforms | ["Linux","macOS","Windows","Network Devices"] |
| mitre_url | https://attack.mitre.org/techniques/T1547 |
| tech_stack | ["linux","macos","windows","network devices"] |
| cwe_ids | ["CWE-276"] |
| chains_with | ["T1547.001","T1547.002","T1547.003","T1547.004","T1547.005","T1547.006","T1547.007","T1547.008","T1547.009","T1547.010","T1547.012","T1547.013","T1547.014","T1547.015"] |
| prerequisites | [] |
| severity_boost | {"T1547.001":"Chain with T1547.001 for deeper attack path","T1547.002":"Chain with T1547.002 for deeper attack path","T1547.003":"Chain with T1547.003 for deeper attack path"} |
Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon. These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel.
Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.
Platforms: Linux, macOS, Windows, Network Devices
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Install a driver via pnputil.exe lolbin
Supported Platforms: windows
pnputil.exe /add-driver "#{driver_inf}"
pnputil.exe is a native command-line utility in Windows to install drivers, this can be abused by to install malicious drivers. Ref: https://lolbas-project.github.io/lolbas/Binaries/Pnputil/
Supported Platforms: windows
pnputil.exe -i -a #{driver_path}
Virtual Channels can be leveraged to alter RDP behavior using dedicated Addins.The mechanism is implemented using DLLs which can be executed during RDP session automatically. The DLLs are loaded in the host system only after successful connection is established with the remote system. Once the test is run, amsi.dll will be loaded on the host system during successful RDP session. Blog :https://learn.microsoft.com/en-us/windows/win32/termserv/terminal-services-virtual-channels?redirectedfrom=MSDN
Supported Platforms: windows Elevation Required: Yes
reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default\Addins\#{Subkey_Added}" /v Name /t REG_SZ /d "#{dll_inf}" /f
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to Boot or Logon Autostart Execution by examining the target platforms (Linux, macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1547 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
No specific mitigations documented for this technique.
| Finding | Severity | Impact |
|---|---|---|
| Boot or Logon Autostart Execution technique applicable | High | Persistence |
| CWE ID | Title |
|---|---|
| CWE-276 | Incorrect Default Permissions |