T1547.014 Active Setup in MITRE ATT&CK Explained

What Is T1547.014 Active Setup in MITRE ATT&CK?

T1547.014 Active Setup is a technique in the MITRE ATT&CK framework under the Persistence tactic. It refers to a Windows feature that automatically executes specific programs or scripts during user login, primarily used to configure user profiles upon the first login.

Active Setup allows for the execution of code tailored to each user profile, ensuring that necessary configuration steps are performed when a user logs into their system for the first time. This mechanism is often used for legitimate tasks such as setting up user-specific configurations or initializing user-related settings but can also be exploited for other purposes.

To read about other sub-techniques of the T1547 Boot Logon or Auto Start Execution technique, you can visit the related hub blog.

Adversary Use of T1547.014 Active Setup

Active Setup is a Windows mechanism originally designed to execute commands once per user account during their first login after software installation. Adversaries exploit this legitimate functionality to establish persistence by ensuring their malicious code executes automatically whenever any user logs into the compromised system.

The Active Setup mechanism operates through a specific registry location:

Each subkey under this path represents a component that should be executed during user login.

Key Registry Values

Within each component subkey, adversaries manipulate specific values:

• StubPath: The primary execution vector - contains the command or executable path to run
• Version: Used to track whether the component has executed for a specific user (stored per-user in HKCU)
• IsInstalled: A DWORD value that determines if the component is active (typically set to 1)

Basic Persistence Setup

In the basic persistence step up case, an adversary would create a new subkey with a GUID or legitimate-sounding name:

Then populate the StubPath value with their payload:

Or execute commands directly:

Execution Flow

When a user logs in, Windows checks Active Setup components in HKLM against a per-user tracking location:

If the HKLM version is newer than (or doesn't exist in) the HKCU location, Windows executes the StubPath command and updates the user's registry to prevent re-execution.

An example malware sample from December 2025 using this technique can be found here:

Procedure Examples Used by Adversaries in Red Report 2025

For example, in a malware sample analyzed in January 2024 within a sandbox environment, a malicious StubPath was observed pointing to [1]:

Another example is coming from the backdoor trojan Poisonivy, which uses this technique for persistence. Detected by Microsoft Defender Antivirus as Backdoor:Win32/Poisonivy.E, Poisonivy is known for unauthorized access and control capabilities. It modifies the registry to ensure automatic execution:

This command adds a StubPath value pointing to c:\windows:svvchost.exe, a malicious executable. When a user logs in, this executable is automatically launched, allowing Poisonivy to maintain persistence and control over the machine. The trojan further hides its presence by injecting itself into processes like iexplore.exe, evading firewall detection and executing commands received from a remote server.

The Active Setup attack technique, characterized by the abuse of inherent system features, presents a significant challenge for mitigation through preventive controls. Since it leverages legitimate functionalities and processes of the operating system, distinguishing between normal and malicious use becomes complex. Standard preventive measures may not effectively counteract these tactics without potentially impacting regular system operations, necessitating a more nuanced approach to detection and response.

Validate Your Defenses Against the Red Report 2026 Threats

References

[1] Joe Security LLC, “Automated Malware Analysis Report for Setup.exe - Generated by Joe Sandbox,” Joe Security LLC. Available: https://www.joesandbox.com/analysis/1372254/0/html. [Accessed: Dec. 16, 2024]