Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Поиск
Вход Регистрация
MITRE ATT&CK - Техника Автозапуск при загрузке или входе в систему
EN
Риски
Каталоги
MITRE ATT&CK
Техника
Автозапуск при загрузке или вх...
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

Автозапуск при загрузке или входе в систему

ID Name
.001 Ключи запуска в реестре / Папка автозагрузки
.002 Пакет аутентификации
.003 Поставщики времени
.004 DLL-библиотеки загружаемые с помощью Winlogon
.005 Поставщик поддержки безопасности (SSP)
.006 Модули и расширения ядра
.007 Перезапуск приложений
.008 Драйвер LSASS
.009 Изменение ярлыков
.010 Мониторы портов
.011 Plist Modification
.012 Обработчики печати
.013 Записи автозапуска XDG
.014 Активная установка
.015 Элементы входа в систему

Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming) These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel. Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.

ID: T1547
Суб-техники:  .001 .002 .003 .004 .005 .006 .007 .008 .009 .010 .011 .012 .013 .014 .015
Тактика(-и): Persistence, Privilege Escalation
Платформы: Linux, Network Devices, Windows, macOS
Источники данных: Command: Command Execution, Driver: Driver Load, File: File Creation, File: File Modification, Kernel: Kernel Module Load, Module: Module Load, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Версия: 1.3
Дата создания: 23 Jan 2020
Последнее изменение: 15 Apr 2025

Примеры процедур
Название Описание
Misdat

Misdat has created registry keys for persistence, including `HKCU\Software\dnimtsoleht\StubPath`, `HKCU\Software\snimtsOleht\StubPath`, `HKCU\Software\Backtsaleht\StubPath`, `HKLM\SOFTWARE\Microsoft\Active Setup\Installed. Components\{3bf41072-b2b1-21c8-b5c1-bd56d32fbda7}`, and `HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{3ef41072-a2f1-21c8-c5c1-70c2c3bc7905}`.(Citation: Cylance Dust Storm)

xCaon

xCaon has added persistence via the Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load which causes the malware to run each time any user logs in.(Citation: Checkpoint IndigoZebra July 2021)
BoxCaon

BoxCaon established persistence by setting the HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load registry key to point to its executable.(Citation: Checkpoint IndigoZebra July 2021)
Mis-Type

Mis-Type has created registry keys for persistence, including `HKCU\Software\bkfouerioyou`, `HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{6afa8072-b2b1-31a8-b5c1-{Unique Identifier}`, and `HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{3BF41072-B2B1-31A8-B5C1-{Unique Identifier}`.(Citation: Cylance Dust Storm)
Dtrack

Dtrack’s RAT makes a persistent target file with auto execution on the host start.(Citation: Securelist Dtrack)
APT42

APT42 has modified the Registry to maintain persistence.(Citation: Mandiant APT42-charms)

Обнаружение

Monitor for additions or modifications of mechanisms that could be used to trigger autostart execution, such as relevant additions to the Registry. Look for changes that are not correlated with known updates, patches, or other planned administrative activity. Tools such as Sysinternals Autoruns may also be used to detect system autostart configuration changes that could be attempts at persistence.(Citation: TechNet Autoruns) Changes to some autostart configuration settings may happen under normal conditions when legitimate software is installed. Suspicious program execution as autostart programs may show up as outlier processes that have not been seen before when compared against historical data.To increase confidence of malicious activity, data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement. Monitor DLL loads by processes, specifically looking for DLLs that are not recognized or not normally loaded into a process. Look for abnormal process behavior that may be due to a process loading a malicious DLL. Monitor for abnormal usage of utilities and command-line parameters involved in kernel modification or driver installation.

Ссылки

  1. Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.
  2. Pomerantz, O., Salzman, P.. (2003, April 4). The Linux Kernel Module Programming Guide. Retrieved April 6, 2018.
  3. Microsoft. (n.d.). Authentication Packages. Retrieved March 1, 2017.
  4. Microsoft. (n.d.). Run and RunOnce Registry Keys. Retrieved September 12, 2024.
  5. Mandiant. (n.d.). APT42: Crooked Charms, Cons and Compromises. Retrieved October 9, 2024.
  6. Microsoft. (n.d.). Time Provider. Retrieved March 26, 2018.
  7. Langendorf, S. (2013, September 24). Windows Registry Persistence, Part 2: The Run Keys and Search-Order. Retrieved November 17, 2024.
  8. Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.
  9. CheckPoint Research. (2021, July 1). IndigoZebra APT continues to attack Central Asia with evolving tools. Retrieved September 24, 2021.
  10. Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.
Навигация

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.