ATT&CK coverage › Technique

Boot or Logon Initialization Scripts T1037

Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely.

Events covered

2 catalog events are tagged with this technique by at least one rule.

ProviderEvent IDTitle
Security-Auditing5136A directory service object was modified.
Security-Auditing5145A network share object was checked to see whether client can be granted desired access.

Authoring guide

Patterns shared across the 1 rule above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (5 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
RelativeTargetName1ends_with 1\scripts.ini, \psscripts.ini
AttributeValue1match 142B5FAAE-6536-11D2-AE5A-0000F87571E3, 40B66650-4972-11D1-A7CA-0000F87571E3, 40B6664F-4972-11D1-A7CA-0000F87571E3
AccessList1match 1%%4417
AttributeLDAPDisplayName1eq 1gPCUserExtensionNames, gPCMachineExtensionNames
ShareName1wildcard 1\\*\SYSVOL

Top indicator values (9 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.

FieldKindValueRules (here)Corpus reach
AttributeLDAPDisplayNameeqgPCMachineExtensionNames14
AttributeValuematch40B66650-4972-11D1-A7CA-0000F87571E31
RelativeTargetNameends_with\scripts.ini1
AttributeLDAPDisplayNameeqgPCUserExtensionNames12
RelativeTargetNameends_with\psscripts.ini1
AttributeValuematch42B5FAAE-6536-11D2-AE5A-0000F87571E31
AccessListmatch%%441713
AttributeValuematch40B6664F-4972-11D1-A7CA-0000F87571E31
ShareNamewildcard\\*\SYSVOL12

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Elastic 1 rule