Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine. Active Setup is a Windows mechanism that is used to execute programs when a user logs in. The value stored in the Registry key will be executed after a user logs into the computer.(Citation: Klein Active Setup 2010) These programs will be executed under the context of the user and will have the account's associated permissions level.

Adversaries may abuse Active Setup by creating a key under <code> HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\</code> and setting a malicious value for <code>StubPath</code>. This value will serve as the program that will be executed when a user logs into the computer.(Citation: Mandiant Glyer APT 2010)(Citation: Citizenlab Packrat 2015)(Citation: FireEye CFR Watering Hole 2012)(Citation: SECURELIST Bright Star 2015)(Citation: paloalto Tropic Trooper 2016)

Adversaries can abuse these components to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.
Active Setup
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1547/014  external_id: T1547.014     source_name: SECURELIST Bright Star 2015  description: Baumgartner, K., Guerrero-Saade, J. (2015, March 4). Who’s Really Spreading through the Bright Star?. Retrieved December 18, 2020.  url: https://securelist.com/whos-really-spreading-through-the-bright-star/68978/     source_name: Mandiant Glyer APT 2010  description: Glyer, C. (2010). Examples of Recent APT Persistence Mechanism. Retrieved December 18, 2020.  url: https://digital-forensics.sans.org/summit-archives/2010/35-glyer-apt-persistence-mechanisms.pdf     source_name: FireEye CFR Watering Hole 2012  description: Kindlund, D. (2012, December 30). CFR Watering Hole Attack Details. Retrieved December 18, 2020.  url: https://www.fireeye.com/blog/threat-research/2012/12/council-foreign-relations-water-hole-attack-details.html     source_name: Klein Active Setup 2010  description: Klein, H. (2010, April 22). Active Setup Explained. Retrieved December 18, 2020.  url: https://helgeklein.com/blog/2010/04/active-setup-explained/     source_name: paloalto Tropic Trooper 2016  description: Ray, V., et al. (2016, November 22). Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy. Retrieved December 18, 2020.  url: https://unit42.paloaltonetworks.com/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/     source_name: TechNet Autoruns  description: Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.  url: https://technet.microsoft.com/en-us/sysinternals/bb963902     source_name: Citizenlab Packrat 2015  description: Scott-Railton, J., et al. (2015, December 8). Packrat. Retrieved December 18, 2020.  url: https://citizenlab.ca/2015/12/packrat-report/     