Activity timeline
T1547 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 109 reports, and 349 of the 349 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1547 Boot or Logon Autostart Execution is catalogued by MITRE ATT&CK under the Persistence and Privilege Escalation tactics in the Enterprise matrix. Threadlinqs maps 349 of 2623 tracked threats (13.3%) to it; by severity that is 106 critical, 219 high, 20 medium, 1 low.
Threats that use T1547 most often also use T1059 Command and Scripting Interpreter (276 threats), T1071 Application Layer Protocol (264 threats), T1082 System Information Discovery (256 threats), T1027 Obfuscated Files or Information (255 threats), T1036 Masquerading (235 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
114 tracked threat actors appear in the threats that use T1547; the most frequent are APT38 (14), Sapphire Sleet (14), Stardust Chollima (13), MuddyWater (12), TeamPCP (11).
Data sources
Telemetry that can reveal T1547, per MITRE ATT&CK.
- Command — Command Execution
- Driver — Driver Load
- File — File Creation, File Modification
- Kernel — Kernel Module Load
- Module — Module Load
- Process — OS API Execution, Process Creation
- Windows Registry — Windows Registry Key Creation, Windows Registry Key Modification
Threat actors using it
Tracked threats
The 30 most recent of 349 tracked threats that use T1547.
- TWEAKOS Stealer: Discord Token Theft and Telegram Account-Takeover Marketplacemedium
- TokenGrabber: Python-based MaaS Infostealer Builderhigh
- Compromised HBO Max Reddit Account Distributes ClickFix Malware in "PasteSwitch" Cross-Platform Malvertising…high
- LegionLoader Malware Distributed via Fake Cloudflare CAPTCHA Using the ClickFix Techniquemedium
- SloppyRAT: New Remote Access Trojan Deployed via ClickFix in Ransomware-Linked Attackshigh
- September 2026 Microsoft Patch Tuesday — Record 966+ Vulnerabilities with Two Actively Exploited Zero-Days…critical
- QuimaRAT v2.0 — Java-Based Cross-Platform Remote Access Trojan Offered as Malware-as-a-Servicehigh
- REVSTEALER (REF2859): Emerging Windows infostealer with App-Bound encryption bypass, Polygon blockchain C2…high
- Fake GlobalProtect MSI Targets Myanmar Using Cloudflare Workers and Google Sheets API as C2high
- FalconFlank Zero-Day Local Privilege Escalation in CrowdStrike Falcon Sensor via Office Macro Remediation…high
- Vexy Ransomware (RaaS) claims Sancity (sancity.in) — Indian real estate/construction group; 130 MB data…medium
- Node.js Living-off-the-Land: Multiple Threat Actors Abuse Signed node.exe as a Script Interpreter, Feeding…high
- Mustang Panda Targets India's Government and Energy Sectors with SHARDLOADER, MINIRECON, and ZOHOMURKhigh
- ValleyRAT (Winos 4.0) Backdoor Hides in Signed QN Wallpaper Installer via DLL Sideloadinghigh
- TA4922 Deploys PackClient RAT via Tax-Themed Phishing Against Organizations in China and Indiahigh
- Chaos Ransomware Claims MacAllister (macallister.com) — 75GB Data Exfiltration Claimed, Leadership Refused…high
- TonRAT Phishing Campaign Impersonating Booking.com Targets Hotel Industryhigh
- Dark Caracal Expands Espionage Arsenal with GoCaracal Framework and AsioGate Backdoorhigh
- 2026 Ransomware Surge Targeting US Organizations: Identity-First Compromise, BYOVD, and Living-Off-the-Cloud…high
- SmartApeSG ClickFix Campaign Delivering Two-Stage RAT Infection via Fake CAPTCHA Social Engineering on…high
- SynkLoader: New Multi-Module Malware Family Distributed via Microsoft Teams Phishing Campaign Targeting…high
- SilkParasite: China-Nexus Cyber Espionage Campaign Targeting Central Asian Governmentscritical
- Hackers poison arrayref Rust crate (0.3.10) via proc-macro1 typosquat to push DPRK-linked cross-platform…critical
- Russia (GRU Unit 26165 / APT28) Runs Multi-Vector Surveillance, Intimidation, Sabotage and Cyber Espionage…high
- Apple Expands On-Device Lock Screen Alerts for Mercenary Spyware Targetshigh
- Microsoft August 2026 Patch Tuesday: 400 Flaws Fixed, Including Lazarus-Exploited Zero-Day CVE-2026-68820…critical
- Aeternum Loader Uses Polygon Blockchain Smart Contracts for Resilient C2, Deploys XWorm and XMRighigh
- TXTBOOK: Dependency Confusion Campaign Drops Sliver via DNS TXT-Record Staging Against T-Bankhigh
- Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures — Atomic Stealer (AMOS) and…high
- XCSSET v40 macOS Malware Targeting Developers via Compromised Xcode Projectshigh
Detection coverage
Threadlinqs maintains 117 detection rules mapped to T1547 (SPL 34, KQL 42, Sigma 41). Rule content is available to Blue tier accounts and above; this page shows counts only.
Sub-techniques
- T1547.001 Registry Run Keys / Startup Folder — 242 tracked threats
- T1547.002 Authentication Package — 2 tracked threats
- T1547.003 Time Providers — 0 tracked threats
- T1547.004 Winlogon Helper DLL — 6 tracked threats
- T1547.005 Security Support Provider — 3 tracked threats
- T1547.006 Kernel Modules and Extensions — 15 tracked threats
- T1547.007 Re-opened Applications — 0 tracked threats
- T1547.008 LSASS Driver — 0 tracked threats
- T1547.009 Shortcut Modification — 11 tracked threats
- T1547.010 Port Monitors — 0 tracked threats
- T1547.011 Plist Modification — 0 tracked threats
- T1547.012 Print Processors — 0 tracked threats
- T1547.013 XDG Autostart Entries — 10 tracked threats
- T1547.014 Active Setup — 4 tracked threats
- T1547.015 Login Items — 6 tracked threats