Cross-source coverage

T1037 / ATT&CK

Boot or Logon Initialization Scripts

52 rules across 7 sources.

3 deprecated hidden · include 2 atomic-IOC hidden · include

From MITRE ATT&CK 19.2

Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely.

Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.

An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.

Platforms
ESXi · Linux · macOS · Network Devices · Windows
Telemetry
WinEventLog:SecurityWinEventLog:TaskSchedulerauditd:SYSCALLauditd:PATHlinux:osquerymacos:unifiedlogfs:fsusagemacos:osqueryesxi:vmkernelesxi:hostdnetworkdevice:syslog

How MITRE says to detect it DET0112

Boot or Logon Initialization Scripts Detection Strategy

Windows Analytic 0311

Monitoring modification and execution of user or system logon scripts such as in registry Run keys or startup folders.

  • WinEventLog:Security EventCode=4688
  • WinEventLog:Security EventCode=4657
  • WinEventLog:TaskScheduler EventCode=106

Linux Analytic 0312

Detection of changes or execution of shell initialization scripts like.bashrc,.profile, or /etc/profile for persistence.

  • auditd:SYSCALL EXECVE
  • auditd:PATH PATH
  • linux:osquery file_events

macOS Analytic 0313

Monitoring for modification and execution of login hook scripts or LaunchAgents/LaunchDaemons used for persistence.

  • macos:unifiedlog log
  • fs:fsusage file
  • macos:osquery launchd

ESXi Analytic 0314

Detection of modification to ESXi rc.local.d or rc scripts that are used to execute on boot.

  • esxi:vmkernel boot
  • esxi:hostd boot

Network Devices Analytic 0315

Detection of changes to device startup-config files that include boot scripts or scheduled execution routines.

  • networkdevice:syslog config

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 52 above — a rule tagged a sub-technique covers this technique too.

elastic/detection-rules

26 rules
Detection Severity Format
GenAI Process Accessing Sensitive Files High Elastic TOML
Process Spawned from Message-of-the-Day (MOTD) High Elastic TOML
rc.local/rc.common File Creation High Elastic TOML
Suspicious Echo or Printf Execution Detected via Defend for Containers High Elastic TOML
Suspicious StartupItem Plist Creation High Elastic TOML
Azure VM Extension CRUD Operation with Unusual Source ASN Medium Elastic TOML
Chkconfig Service Add Medium Elastic TOML
Executable Bit Set for Potential Persistence Script Medium Elastic TOML
Message-of-the-Day (MOTD) File Creation Medium Elastic TOML
Persistence via Folder Action Script Medium Elastic TOML

+ 16 more from elastic/detection-rules → showing the 10 highest-severity

elastic/protections-artifacts

9 rules
Detection Severity Format
At Utility Launched through Udevadm Undefined Elastic TOML
Egress Network Connection by MOTD Child Undefined Elastic TOML
Persistence via GenAI Tool Undefined Elastic TOML
Potential Remote Code Execution via URL Encoded Payload Undefined Elastic TOML
Suspicious Echo Execution Undefined Elastic TOML
Suspicious Process Spawned from MOTD Detected Undefined Elastic TOML
System V Init (init.d) Executed Binary from Unusual Location Undefined Elastic TOML
Udev Execution Followed by Egress Network Connection Undefined Elastic TOML
Unusual SSH Parent/Child Execution Undefined Elastic TOML

splunk/security_content

7 rules
Detection Severity Format
Linux File Creation In Init Boot Directory Undefined SPL
Linux File Creation In System Generator Directory Undefined SPL
Linux MOTD Script Added Undefined SPL
Linux Suspicious XDG Autostart Undefined SPL
Linux UDEV Rule Created Undefined SPL
Logon Script Event Trigger Execution Undefined SPL
MacOS LoginHook Persistence Undefined SPL

SigmaHQ/sigma

4 rules
Detection Severity Format
Potential Persistence Via Logon Scripts - CommandLine High Sigma
Uncommon Userinit Child Process High Sigma
Potential Persistence Via Logon Scripts - Registry Medium Sigma
Startup Item File Created - MacOS Low Sigma

socfortress/Wazuh-Rules

4 rules
Detection Severity Format
Sysmon - Event 1: Process creation · Reg.exe setting UserInitMprLogonScript (T1037.001) High Wazuh XML
Sysmon - Event 12: RegistryEvent (Object create and delete) by · Boot or Logon Initialization Scripts (T1037) Low Wazuh XML
Sysmon - Event 13: RegistryEvent (Value Set) by · Boot or Logon Initialization Scripts (T1037) Low Wazuh XML
Sysmon - Event 14: RegistryEvent (Key and Value Rename) by · Boot or Logon Initialization Scripts (T1037) Low Wazuh XML

chronicle/detection-rules

1 rule
Detection Severity Format
aws_ec2_user_data_modified High YARA-L

panther-labs/panther-analysis

1 rule
Detection Severity Format
Databricks Global Init Script Changes Informational Panther Python

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.