Skip to content
Every technique
T1037No distinct observable

Boot or Logon Initialization Scripts

Persistence · Privilege EscalationESXi, Linux, macOS, Network Devices, Windows

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

None of the three analytics describes an observable the T1037 parent owns. AN0311 (Windows) is explicitly 'registry Run keys or startup folders' — that is T1547.001's own mechanism, a different technique family; the parent's actual Windows form, the UserInitMprLogonScript value under HKCU\Environment, belongs to the child T1037.001, and the analytic's third log source (TaskScheduler EventID 106) is T1053 entirely. AN0312 (Linux) keys on modification and execution of.bashrc,.profile and /etc/profile, which ATT&CK models as T1546.004 Unix Shell Configuration Modification, not as T1037; the T1037 child that covers Linux boot scripts is T1037.004 (RC Scripts) and its /etc/rc.local surface is not what AN0312 describes. AN0313 (macOS) mixes login hooks, which are the child T1037.002, with LaunchAgents and LaunchDaemons, which ATT&CK places under T1543.001 and T1547.015. […]

Covered instead by T1037.001, T1037.002, T1037.004, T1546.004, T1547.001, T1543.001.

What the technique is

Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely. Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.

Read it on attack.mitre.org

What MITRE says you would watch

  • AN0311

    Monitoring modification and execution of user or system logon scripts such as in registry Run keys or startup folders.

  • AN0312

    Detection of changes or execution of shell initialization scripts like.bashrc,.profile, or /etc/profile for persistence.

  • AN0313

    Monitoring for modification and execution of login hook scripts or LaunchAgents/LaunchDaemons used for persistence.

Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.