Registry Run Keys and Startup Folder

The two most common boot/logon autostart locations on Windows are the Run/RunOnce registry keys and the Startup folders. Anything registered in either executes when a user logs on, which makes them the standard persistence primitive — MITRE ATT&CK T1547.001 — Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder.

Registry Run keys

Four keys cover the per-user and per-machine cases:

• HKCU\Software\Microsoft\Windows\CurrentVersion\Run
• HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
• HKLM\Software\Microsoft\Windows\CurrentVersion\Run
• HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

Scope: HKCU entries run only for the current user; HKLM entries run at every (normal) logon. Writing under HKLM requires administrator rights, so HKCU is the low-privilege persistence location and HKLM the system-wide one.

Semantics: values under Run execute every logon; values under RunOnce execute once and are deleted (RunOnce exists primarily so installers can schedule post-reboot cleanup). Each entry is a name/value pair where the value is the command line; REG_EXPAND_SZ allows environment-variable expansion (%TEMP%, %APPDATA%) in the path, which is also a handy way to make the entry look innocuous.

# Add a per-user persistence entry
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" `
    /v Updater /t REG_EXPAND_SZ /d "%TEMP%\payload.exe"

Startup folders

The filesystem equivalent: shortcuts (or executables) dropped in a Startup folder launch at logon.

• Per-user: C:\Users\<USERNAME>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
• All users: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup (requires admin to write)

A user’s effective startup set is the union of the two. Executables placed here run directly, not just .lnk shortcuts — which matters for both hiding (a .lnk with a decoy icon blends in) and detection (don’t just look for shortcuts).

Offense and defense

These are the first places both attackers and defenders look:

• Enumeration: reg query on the four keys, plus listing both Startup folders. Autoruns (Sysinternals) consolidates them with dozens of other autostart extensibility points.
• Detection: new Run-key values or new Startup-folder items on a workstation are high-signal persistence events; Sysmon EID 13 (registry value set) and EID 11 (file create) cover them respectively.
• Hiding: attackers name entries after legitimate updaters; the RunOnce self-deletion can be abused to leave a small footprint.

Related

• windows-services — the other primary autostart mechanism, running under a service account rather than the interactive user
• winlogon-autostart-values — logon-time execution via the Winlogon Userinit/Shell values (T1547.004)
• windows-file-association-hijacking — persistence by redirecting what the OS launches

Sources

• MITRE ATT&CK — T1547.001
• Microsoft Learn — Run and RunOnce Registry Keys