Startup RC or init script edited by a file-writing tool

1title: Startup RC or init script edited by a file-writing tool2id: aaa7ee56-b105-4e44-a364-cc3c5cb25ad53status: experimental4description: |5  AN0658 pairs modification of /etc/rc.local or an /etc/init.d script with the6  suspicious execution that follows at the next boot. Only the modification half7  is a single event: the boot half needs MITRE's `time_window` knob to link a8  write to a reboot minutes or days later, and lib/sigma has no timeframe and no9  cross-event join. So this rule matches the edit itself — a process whose10  command line names one of the RC script locations, launched either as a11  file-writing or editing utility (tee, sed, cp, install, chmod, an editor) or12  with a shell redirect aimed at one of those paths. The two forms are ORed13  because they are the same act reached two ways: `vi /etc/rc.local` and14  `sh -c 'echo /tmp/x >> /etc/rc.local'` both plant the persistence, but in the15  second the executable is a shell and only the redirect distinguishes it. The16  redirect arm matches the operator immediately followed by an RC path17  (`> /etc/init.d/` and `>/etc/init.d/`, which also cover the `>>` append form)18  rather than the operator anywhere on the line — an unanchored `>>` would fire19  on `/etc/init.d/foo start >> /var/log/foo.log` and on20  `cat /etc/rc.local >> /tmp/out`, neither of which writes the script. Shells21  are deliberately absent from the tool list: systemd's rc-local.service runs the22  script at every boot as `/bin/sh /etc/rc.local`, which would otherwise match23  once per boot on every host and match nothing an adversary did. The editor24  entries carry the Debian alternatives targets (vim.basic, vim.tiny, vim.nox)25  alongside `/vi` and `/vim`, because the exec record names the resolved binary26  and `vi` on a Debian-family host resolves to one of those. MITRE's27  `script_path` knob is what the path list implements, populated here with the28  Debian, RHEL, BSD-style and ESXi locations rather than taken from MITRE;29  dropping `/etc/init.d/` from it removes this rule's loudest false positive and30  would justify a higher level. Its `user_context` and `file_permission` knobs31  are not applied — root is the expected context for every legitimate match here32  as well as every malicious one.33  Vocabulary and limits. The brief maps `auditd:SYSCALL::execve` onto the Sigma34  `process_creation` category, which is Sysmon-for-Linux-shaped (`Image`,35  `CommandLine`); raw auditd splits the same execution across a SYSCALL record36  carrying `exe` and an EXECVE record carrying `a0`, `a1`, … , so that feed needs37  a field mapping before this rule can match on it. Nothing that writes the file38  without exec'ing a helper is visible: a Python or Perl implant that opens39  /etc/rc.local directly, or an interactive shell where the redirect is performed40  by the already-running shell and creates no new process, leaves no matching41  event. The brief's second source, `linux:syslog` boot logs, is not used — it42  has no standardised Sigma field vocabulary and boot messages name no script43  path. AN0659 (macOS) offers only `macos:unifiedlog`, which likewise has no44  standardised field names, so /etc/rc.common and the StartupItems trees are out45  of reach here even though the path list includes rc.common. ESXi's46  /etc/rc.local.d/local.sh is listed for completeness, but ESXi ships neither47  auditd nor Sysmon for Linux, so that entry only fires on a Linux host that uses48  the path. Prerequisite: neither feed exists by default. Sysmon for Linux is a49  separate agent no distribution installs, and stock auditd records no execve50  until a rule such as `-a always,exit -F arch=b64 -S execve -k exec` is loaded —51  until then this rule returns zero rows, and zero rows here means blind, not52  quiet.53  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0237, not hand-written and not tested by its author. Any lab result is on this rule's own page.54references:55  - https://attack.mitre.org/techniques/T1037/00456  - https://attack.mitre.org/detectionstrategies/DET023757author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)58date: 2026-08-1759tags:60  - attack.persistence61  - attack.privilege-escalation62  - attack.t1037.00463logsource:64  category: process_creation65  product: linux66detection:67  selection_rc_path:68    CommandLine|contains:69      - '/etc/rc.local'70      - '/etc/rc.common'71      - '/etc/rc.d/rc.local'72      - '/etc/rc.local.d/'73      - '/etc/init.d/'74      - '/etc/rc.d/init.d/'75  selection_write_tool:76    Image|endswith:77      - '/tee'78      - '/sed'79      - '/cp'80      - '/mv'81      - '/ln'82      - '/install'83      - '/chmod'84      - '/chown'85      - '/dd'86      - '/patch'87      - '/truncate'88      - '/ed'89      - '/vi'90      - '/vim'91      - '/vim.basic'92      - '/vim.tiny'93      - '/vim.nox'94      - '/nvim'95      - '/nano'96      - '/pico'97      - '/emacs'98      - '/gedit'99  selection_redirect_to_rc:100    CommandLine|contains:101      - '> /etc/rc.local'102      - '>/etc/rc.local'103      - '> /etc/rc.common'104      - '>/etc/rc.common'105      - '> /etc/rc.d/rc.local'106      - '>/etc/rc.d/rc.local'107      - '> /etc/rc.local.d/'108      - '>/etc/rc.local.d/'109      - '> /etc/init.d/'110      - '>/etc/init.d/'111      - '> /etc/rc.d/init.d/'112      - '>/etc/rc.d/init.d/'113  condition: selection_rc_path and (selection_write_tool or selection_redirect_to_rc)114falsepositives:115  - "Package management. Installing, upgrading or removing any package that still ships a SysV init script makes the dpkg or rpm maintainer script run cp, install, ln or chmod against /etc/init.d/<name>, so a single patch window produces matching events on every host in the fleet. This is the rule's highest-volume source by a wide margin and is why the level is low rather than medium."116  - "Configuration management reapplying startup files on every convergence run — a Puppet or Chef exec resource, a Salt cmd.run, or an Ansible shell or command task doing cp, sed -i or chmod against /etc/rc.local or an init script — which fires on schedule whether or not the file content actually changed."117  - "Image build and provisioning steps: kickstart and preseed %post sections, cloud-init runcmd, Packer shell provisioners and Dockerfile RUN lines that append a startup command to /etc/rc.local or chmod +x an init script, producing a burst of matches for every image built."118  - "An administrator legitimately adding a boot-time command by hand, opening /etc/rc.local in vi or nano or appending to it with tee -a. This remains a normal way to schedule work on appliances, embedded builds and hosts that predate systemd, and the event is indistinguishable from the malicious form apart from the account and the change record."119level: low