Applied Cybernetics Group
T1037 Boot or Logon Initialization Scripts
- Technique
T1037- Tactics
- Persistence, Privilege Escalation
- Research, 90 days
- 1
- KEV CVEs mapped
- 3
- SigmaHQ rules
- 0
- Elastic, Splunk
- 30
- thrunt rules
- 1
- Upstream
- https://attack.mitre.org/techniques/T1037
MITRE description
Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.(Citation: Mandiant APT29 Eye Spy Email Nov 22)(Citation: Anomali Rocke March 2019) Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely. Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.
KEV CVEs mapped to this technique
MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-28Cisco Talos: Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
Detection coverage
thrunt rules
Elastic and Splunk rules
- GenAI Process Accessing Sensitive Files (elastic)
- Azure VM Extension CRUD Operation with Unusual Source ASN (elastic)
- Unusual Azure VM Extension Detected (elastic)
- Modification of Persistence Relevant Files Detected via Defend for Containers (elastic)
- Suspicious Echo or Printf Execution Detected via Defend for Containers (elastic)
- Potential Persistence via File Modification (elastic)
- Suspicious Network Activity to the Internet by Previously Unknown Executable (elastic)
- Pod or Container Creation with Suspicious Command-Line (elastic)
- Chkconfig Service Add (elastic)
- System V Init Script Created (elastic)
- Message-of-the-Day (MOTD) File Creation (elastic)
- Process Spawned from Message-of-the-Day (MOTD) (elastic)
- Executable Bit Set for Potential Persistence Script (elastic)
- Suspicious rc.local Error Message (elastic)
- Potential Execution of rc.local Script (elastic)
- rc.local/rc.common File Creation (elastic)
- Potential Suspicious File Edit (elastic)
- Systemd-udevd Rule File Creation (elastic)
- Unusual Exim4 Child Process (elastic)
- Persistence via Folder Action Script (elastic)
- Persistence via Login or Logout Hook (elastic)
- Potential Persistence via Login Hook (elastic)
- Suspicious StartupItem Plist Creation (elastic)
- Potential Persistence via Atom Init Script Modification (elastic)
- Uncommon Registry Persistence Change (elastic)
Showing 25 of 30.