# T1547 Boot or Logon Autostart Execution > As of 2026-10-05, T1547 (Boot or Logon Autostart Execution) appears in 349 tracked threats, first reported 2026-01-19 and most recently 2026-09-27, with linked actors including APT38, Sapphire Sleet, Stardust Chollima; it most often appears alongside T1059 (Command and Scripting Interpreter). - **Tracked threats:** 349 (106 critical, 219 high, 20 medium, 1 low) - **First seen:** 2026-01-19 - **Last seen:** 2026-09-27 - **Threat actors:** 114 - **Detection rules:** 117 (counts only; Blue tier and above) ## Key facts - **ID:** T1547 - **Framework:** MITRE ATT&CK - **Tactics:** Persistence, Privilege Escalation - **Matrix:** Enterprise - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1547/ ## Activity timeline T1547 first appeared in tracked threats on 2026-01-19 and was most recently reported on 2026-09-27. The busiest month was 2026-07 with 109 reports, and 349 of the 349 threats were reported in the twelve months to 2026-09. ## How adversaries use it T1547 Boot or Logon Autostart Execution is catalogued by MITRE ATT&CK under the Persistence and Privilege Escalation tactics in the Enterprise matrix. Threadlinqs maps 349 of 2623 tracked threats (13.3%) to it; by severity that is 106 critical, 219 high, 20 medium, 1 low. Threats that use T1547 most often also use [T1059 Command and Scripting Interpreter](https://intel.threadlinqs.com/technique/T1059) (276 threats), [T1071 Application Layer Protocol](https://intel.threadlinqs.com/technique/T1071) (264 threats), [T1082 System Information Discovery](https://intel.threadlinqs.com/technique/T1082) (256 threats), [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (255 threats), [T1036 Masquerading](https://intel.threadlinqs.com/technique/T1036) (235 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 114 tracked threat actors appear in the threats that use T1547; the most frequent are [APT38](https://intel.threadlinqs.com/actor/APT38) (14), [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) (14), [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) (13), [MuddyWater](https://intel.threadlinqs.com/actor/MuddyWater) (12), [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) (11). ## Data sources Telemetry that can reveal T1547, per MITRE ATT&CK. - Command — Command Execution - Driver — Driver Load - File — File Creation, File Modification - Kernel — Kernel Module Load - Module — Module Load - Process — OS API Execution, Process Creation - Windows Registry — Windows Registry Key Creation, Windows Registry Key Modification ## Threat actors using it - [APT38](https://intel.threadlinqs.com/actor/APT38) — 14 - [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) — 14 - [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) — 13 - [MuddyWater](https://intel.threadlinqs.com/actor/MuddyWater) — 12 - [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) — 11 - [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) — 8 - [APT28](https://intel.threadlinqs.com/actor/APT28) — 7 - [Andariel](https://intel.threadlinqs.com/actor/Andariel) — 7 - [Contagious Interview](https://intel.threadlinqs.com/actor/Contagious%20Interview) — 7 - [Mustang Panda](https://intel.threadlinqs.com/actor/Mustang%20Panda) — 7 - [UNC1069](https://intel.threadlinqs.com/actor/UNC1069) — 7 - [Forest Blizzard](https://intel.threadlinqs.com/actor/Forest%20Blizzard) — 5 ## Tracked threats The 30 most recent of 349 tracked threats that use T1547. - [TWEAKOS Stealer: Discord Token Theft and Telegram Account-Takeover Marketplace](https://intel.threadlinqs.com/threat/TL-2026-2715) — medium — 2026-09-27 - [TokenGrabber: Python-based MaaS Infostealer Builder](https://intel.threadlinqs.com/threat/TL-2026-2643) — high — 2026-09-25 - [Compromised HBO Max Reddit Account Distributes ClickFix Malware in "PasteSwitch" Cross-Platform Malvertising…](https://intel.threadlinqs.com/threat/TL-2026-2506) — high — 2026-09-14 - [LegionLoader Malware Distributed via Fake Cloudflare CAPTCHA Using the ClickFix Technique](https://intel.threadlinqs.com/threat/TL-2026-2441) — medium — 2026-09-11 - [SloppyRAT: New Remote Access Trojan Deployed via ClickFix in Ransomware-Linked Attacks](https://intel.threadlinqs.com/threat/TL-2026-2439) — high — 2026-09-10 - [September 2026 Microsoft Patch Tuesday — Record 966+ Vulnerabilities with Two Actively Exploited Zero-Days…](https://intel.threadlinqs.com/threat/TL-2026-2398) — critical — 2026-09-08 - [QuimaRAT v2.0 — Java-Based Cross-Platform Remote Access Trojan Offered as Malware-as-a-Service](https://intel.threadlinqs.com/threat/TL-2026-2397) — high — 2026-09-08 - [REVSTEALER (REF2859): Emerging Windows infostealer with App-Bound encryption bypass, Polygon blockchain C2…](https://intel.threadlinqs.com/threat/TL-2026-2370) — high — 2026-09-07 - [Fake GlobalProtect MSI Targets Myanmar Using Cloudflare Workers and Google Sheets API as C2](https://intel.threadlinqs.com/threat/TL-2026-2368) — high — 2026-09-07 - [FalconFlank Zero-Day Local Privilege Escalation in CrowdStrike Falcon Sensor via Office Macro Remediation…](https://intel.threadlinqs.com/threat/TL-2026-2362) — high — 2026-09-06 - [Vexy Ransomware (RaaS) claims Sancity (sancity.in) — Indian real estate/construction group; 130 MB data…](https://intel.threadlinqs.com/threat/TL-2026-2352) — medium — 2026-09-06 - [Node.js Living-off-the-Land: Multiple Threat Actors Abuse Signed node.exe as a Script Interpreter, Feeding…](https://intel.threadlinqs.com/threat/TL-2026-2304) — high — 2026-09-03 - [Mustang Panda Targets India's Government and Energy Sectors with SHARDLOADER, MINIRECON, and ZOHOMURK](https://intel.threadlinqs.com/threat/TL-2026-2293) — high — 2026-09-02 - [ValleyRAT (Winos 4.0) Backdoor Hides in Signed QN Wallpaper Installer via DLL Sideloading](https://intel.threadlinqs.com/threat/TL-2026-2256) — high — 2026-08-31 - [TA4922 Deploys PackClient RAT via Tax-Themed Phishing Against Organizations in China and India](https://intel.threadlinqs.com/threat/TL-2026-2202) — high — 2026-08-29 - [Chaos Ransomware Claims MacAllister (macallister.com) — 75GB Data Exfiltration Claimed, Leadership Refused…](https://intel.threadlinqs.com/threat/TL-2026-2209) — high — 2026-08-28 - [TonRAT Phishing Campaign Impersonating Booking.com Targets Hotel Industry](https://intel.threadlinqs.com/threat/TL-2026-2175) — high — 2026-08-28 - [Dark Caracal Expands Espionage Arsenal with GoCaracal Framework and AsioGate Backdoor](https://intel.threadlinqs.com/threat/TL-2026-2158) — high — 2026-08-26 - [2026 Ransomware Surge Targeting US Organizations: Identity-First Compromise, BYOVD, and Living-Off-the-Cloud…](https://intel.threadlinqs.com/threat/TL-2026-2125) — high — 2026-08-23 - [SmartApeSG ClickFix Campaign Delivering Two-Stage RAT Infection via Fake CAPTCHA Social Engineering on…](https://intel.threadlinqs.com/threat/TL-2026-2101) — high — 2026-08-21 - [SynkLoader: New Multi-Module Malware Family Distributed via Microsoft Teams Phishing Campaign Targeting…](https://intel.threadlinqs.com/threat/TL-2026-2098) — high — 2026-08-21 - [SilkParasite: China-Nexus Cyber Espionage Campaign Targeting Central Asian Governments](https://intel.threadlinqs.com/threat/TL-2026-2090) — critical — 2026-08-20 - [Hackers poison arrayref Rust crate (0.3.10) via proc-macro1 typosquat to push DPRK-linked cross-platform…](https://intel.threadlinqs.com/threat/TL-2026-2089) — critical — 2026-08-20 - [Russia (GRU Unit 26165 / APT28) Runs Multi-Vector Surveillance, Intimidation, Sabotage and Cyber Espionage…](https://intel.threadlinqs.com/threat/TL-2026-2031) — high — 2026-08-16 - [Apple Expands On-Device Lock Screen Alerts for Mercenary Spyware Targets](https://intel.threadlinqs.com/threat/TL-2026-2016) — high — 2026-08-14 - [Microsoft August 2026 Patch Tuesday: 400 Flaws Fixed, Including Lazarus-Exploited Zero-Day CVE-2026-68820…](https://intel.threadlinqs.com/threat/TL-2026-1987) — critical — 2026-08-11 - [Aeternum Loader Uses Polygon Blockchain Smart Contracts for Resilient C2, Deploys XWorm and XMRig](https://intel.threadlinqs.com/threat/TL-2026-1979) — high — 2026-08-10 - [TXTBOOK: Dependency Confusion Campaign Drops Sliver via DNS TXT-Record Staging Against T-Bank](https://intel.threadlinqs.com/threat/TL-2026-1977) — high — 2026-08-10 - [Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures — Atomic Stealer (AMOS) and…](https://intel.threadlinqs.com/threat/TL-2026-1899) — high — 2026-08-05 - [XCSSET v40 macOS Malware Targeting Developers via Compromised Xcode Projects](https://intel.threadlinqs.com/threat/TL-2026-1870) — high — 2026-08-04 ## Related CVEs CVEs referenced by the tracked threats that use T1547, most frequent first. - [CVE-2025-55182](https://intel.threadlinqs.com/cve/CVE-2025-55182) - [CVE-2021-26855](https://intel.threadlinqs.com/cve/CVE-2021-26855) - [CVE-2025-8088](https://intel.threadlinqs.com/cve/CVE-2025-8088) - [CVE-2026-21513](https://intel.threadlinqs.com/cve/CVE-2026-21513) - [CVE-2026-33634](https://intel.threadlinqs.com/cve/CVE-2026-33634) - [CVE-2016-4437](https://intel.threadlinqs.com/cve/CVE-2016-4437) - [CVE-2021-27076](https://intel.threadlinqs.com/cve/CVE-2021-27076) - [CVE-2021-36260](https://intel.threadlinqs.com/cve/CVE-2021-36260) - [CVE-2022-27925](https://intel.threadlinqs.com/cve/CVE-2022-27925) - [CVE-2022-40684](https://intel.threadlinqs.com/cve/CVE-2022-40684) - [CVE-2022-41082](https://intel.threadlinqs.com/cve/CVE-2022-41082) - [CVE-2023-20198](https://intel.threadlinqs.com/cve/CVE-2023-20198) - [CVE-2023-32315](https://intel.threadlinqs.com/cve/CVE-2023-32315) - [CVE-2023-46747](https://intel.threadlinqs.com/cve/CVE-2023-46747) - [CVE-2024-21762](https://intel.threadlinqs.com/cve/CVE-2024-21762) - [CVE-2024-36401](https://intel.threadlinqs.com/cve/CVE-2024-36401) - [CVE-2026-21509](https://intel.threadlinqs.com/cve/CVE-2026-21509) - [CVE-2017-7921](https://intel.threadlinqs.com/cve/CVE-2017-7921) - [CVE-2020-12641](https://intel.threadlinqs.com/cve/CVE-2020-12641) - [CVE-2020-35730](https://intel.threadlinqs.com/cve/CVE-2020-35730) - [CVE-2021-44026](https://intel.threadlinqs.com/cve/CVE-2021-44026) - [CVE-2021-44228](https://intel.threadlinqs.com/cve/CVE-2021-44228) - [CVE-2023-23397](https://intel.threadlinqs.com/cve/CVE-2023-23397) - [CVE-2023-38831](https://intel.threadlinqs.com/cve/CVE-2023-38831) - [CVE-2023-4966](https://intel.threadlinqs.com/cve/CVE-2023-4966) - [CVE-2023-6895](https://intel.threadlinqs.com/cve/CVE-2023-6895) - [CVE-2024-1708](https://intel.threadlinqs.com/cve/CVE-2024-1708) - [CVE-2024-1709](https://intel.threadlinqs.com/cve/CVE-2024-1709) - [CVE-2024-21887](https://intel.threadlinqs.com/cve/CVE-2024-21887) - [CVE-2024-55591](https://intel.threadlinqs.com/cve/CVE-2024-55591) ## Detection coverage Threadlinqs maintains 117 detection rules mapped to T1547 (SPL 34, KQL 42, Sigma 41). Rule content is available to Blue tier accounts and above; this page shows counts only. 117 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Sub-techniques - [T1547.001 Registry Run Keys / Startup Folder](https://intel.threadlinqs.com/technique/T1547.001) — 242 tracked threats - T1547.002 Authentication Package — 2 tracked threats - T1547.003 Time Providers — 0 tracked threats - T1547.004 Winlogon Helper DLL — 6 tracked threats - T1547.005 Security Support Provider — 3 tracked threats - [T1547.006 Kernel Modules and Extensions](https://intel.threadlinqs.com/technique/T1547.006) — 15 tracked threats - T1547.007 Re-opened Applications — 0 tracked threats - T1547.008 LSASS Driver — 0 tracked threats - [T1547.009 Shortcut Modification](https://intel.threadlinqs.com/technique/T1547.009) — 11 tracked threats - T1547.010 Port Monitors — 0 tracked threats - T1547.011 Plist Modification — 0 tracked threats - T1547.012 Print Processors — 0 tracked threats - [T1547.013 XDG Autostart Entries](https://intel.threadlinqs.com/technique/T1547.013) — 10 tracked threats - T1547.014 Active Setup — 4 tracked threats - T1547.015 Login Items — 6 tracked threats ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1547 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)