← Back to ATT&CK index
T1547
Boot or Logon Autostart Execution
View on attack.mitre.org →3 syscalls implement this technique
- NtFlushVirtualMemory
Flushes dirty pages of a file-backed view to disk, similar to FlushViewOfFile.
- NtSetDriverEntryOrder
Rewrites the platform's UEFI DriverOrder list, controlling which UEFI drivers load first at boot.
- NtSetSystemEnvironmentValueEx
Writes or deletes a UEFI variable identified by (name, vendor GUID) — the canonical firmware-persistence surface.