Active Setup

{
  "id": "ATTACK:enterprise:T1547.014",
  "title": "Active Setup",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1547/014",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--22522668-ddf6-470b-a027-9d6866679f67",
  "external_id": "T1547.014",
  "domain": "enterprise",
  "created": "2020-12-18T16:33:13.098Z",
  "modified": "2025-10-24T17:48:31.226Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "persistence",
    "privilege-escalation"
  ],
  "source_references": [
    {
      "source_name": "SECURELIST Bright Star 2015",
      "url": "https://securelist.com/whos-really-spreading-through-the-bright-star/68978/"
    },
    {
      "source_name": "Mandiant Glyer APT 2010",
      "url": "https://digital-forensics.sans.org/summit-archives/2010/35-glyer-apt-persistence-mechanisms.pdf"
    },
    {
      "source_name": "FireEye CFR Watering Hole 2012",
      "url": "https://web.archive.org/web/20201024230407/https://www.fireeye.com/blog/threat-research/2012/12/council-foreign-relations-water-hole-attack-details.html"
    },
    {
      "source_name": "Klein Active Setup 2010",
      "url": "https://helgeklein.com/blog/2010/04/active-setup-explained/"
    },
    {
      "source_name": "paloalto Tropic Trooper 2016",
      "url": "https://unit42.paloaltonetworks.com/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/"
    },
    {
      "source_name": "TechNet Autoruns",
      "url": "https://technet.microsoft.com/en-us/sysinternals/bb963902"
    },
    {
      "source_name": "Citizenlab Packrat 2015",
      "url": "https://citizenlab.ca/2015/12/packrat-report/"
    }
  ]
}