Cross-source coverage
T1037.004 / ATT&CK
Boot or Logon Initialization Scripts: RC Scripts
13 rules across 3 sources.
Showing deprecated rules · back to the default
From MITRE ATT&CK 19.2
Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify.
Adversaries may establish persistence by adding a malicious binary path or shell commands to rc.local, rc.common, and other RC scripts specific to the Unix-like distribution. Upon reboot, the system executes the script's contents as root, resulting in persistence.
Adversary abuse of RC scripts is especially effective for lightweight Unix-like distributions using the root user as default, such as ESXi hypervisors, IoT, or embedded systems. As ESXi servers store most system files in memory and therefore discard changes on shutdown, leveraging /etc/rc.local.d/local.sh is one of the few mechanisms for enabling persistence across reboots.
Several Unix-like systems have moved to Systemd and deprecated the use of RC scripts. This is now a deprecated mechanism in macOS in favor of Launchd. This technique can be used on Mac OS X Panther v10.3 and earlier versions which still execute the RC scripts. To maintain backwards compatibility some systems, such as Ubuntu, will execute the RC scripts if they exist with the correct file permissions.
- Tactics
- Persistence · Privilege Escalation
- Platforms
- macOS · Linux · Network Devices · ESXi
- Telemetry
-
auditd:SYSCALLlinux:syslogmacos:unifiedlogfs:fsusageesxi:syslogesxi:shellnetworkdevice:syslog
How MITRE says to detect it DET0237
Detection Strategy for Boot or Logon Initialization Scripts: RC Scripts
Linux Analytic 0658
Detection of modified or newly created /etc/rc.local or /etc/init.d scripts followed by suspicious execution during system startup.
auditd:SYSCALLexecvelinux:syslogboot logs
macOS Analytic 0659
Detection of edits or additions to /etc/rc.common, /Library/StartupItems, or /System/Library/StartupItems and associated script execution during login or reboot.
macos:unifiedlogprocess eventsfs:fsusagefile activity
ESXi Analytic 0660
Detection of changes to /etc/rc.local.d/local.sh or rc.local during post-boot script execution with abnormal commands or additions.
esxi:syslogboot logsesxi:shelladmin command usage
Network Devices Analytic 0661
Detection of modified boot-time configuration scripts that persist malicious CLI commands across reboots.
networkdevice:syslogstartup-confignetworkdevice:syslogsystem boot logs
elastic/detection-rules
11 rules| Detection | Severity | Format |
|---|---|---|
| GenAI Process Accessing Sensitive Files | High | Elastic TOML |
| rc.local/rc.common File Creation | High | Elastic TOML |
| Deprecated - Suspicious File Creation in /etc for Persistence | Medium | Elastic TOML |
| Executable Bit Set for Potential Persistence Script | Medium | Elastic TOML |
| Pod or Container Creation with Suspicious Command-Line | Medium | Elastic TOML |
| Potential Execution of rc.local Script | Medium | Elastic TOML |
| Suspicious rc.local Error Message | Medium | Elastic TOML |
| Potential Persistence via File Modification | Low | Elastic TOML |
| Potential Suspicious File Edit | Low | Elastic TOML |
| Suspicious Network Activity to the Internet by Previously Unknown Executable | Low | Elastic TOML |
+ 1 more from elastic/detection-rules → showing the 10 highest-severity
elastic/protections-artifacts
1 rule| Detection | Severity | Format |
|---|---|---|
| Persistence via GenAI Tool | Undefined | Elastic TOML |
splunk/security_content
1 rule| Detection | Severity | Format |
|---|---|---|
| Linux File Creation In Init Boot Directory | Undefined | SPL |