Boot or Logon Initialization Scripts T1037
Tactics: Persistence, Privilege Escalation
Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely.
Events covered
13 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 12 | RegistryEvent (Object create and delete) |
| Sysmon | Event ID 13 | RegistryEvent (Value Set) |
| Sysmon | Event ID 14 | RegistryEvent (Key and Value Rename) |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| Security-Auditing | Event ID 5136 | A directory service object was modified. |
| Security-Auditing | Event ID 5145 | A network share object was checked to see whether client can be granted desired access. |
| ESF | exec | Process Execution |
| ESF | open | File Open |
| ESF | create | File or Directory Create |
| ESF | write | File Write |
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
| Sysmon-for-Linux | Event ID 11 | File created |
Authoring guide
These 52 rules share fields, values, and exclusions.
Fields filtered most (36 distinct)
These fields appear most often in rule filters.
Top indicator values (966 distinct)
These values appear most often in rule predicates.
Exclusions (630 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 4 rules
- Potential Persistence Via Logon Scripts - CommandLine
- Potential Persistence Via Logon Scripts - Registry
- Startup Item File Created - MacOS
- Uncommon Userinit Child Process
Elastic 36 rules
- At Utility Launched through Udevadm
- Azure Virtual Machine Configuration Modified
- Azure VM Extension CRUD Operation with Unusual Source ASN
- Chkconfig Service Add
- Egress Network Connection by MOTD Child
- Executable Bit Set for Potential Persistence Script
- GenAI Process Accessing Sensitive Files
- Message-of-the-Day (MOTD) File Creation
- Modification of Persistence Relevant Files Detected via Defend for Containers
- Persistence via Folder Action Script
- Persistence via GenAI Tool
- Persistence via Login or Logout Hook
- Pod or Container Creation with Suspicious Command-Line
- Potential Execution of rc.local Script
- Potential Persistence via Atom Init Script Modification
- Potential Persistence via File Modification
- Potential Persistence via Login Hook
- Potential Remote Code Execution via URL Encoded Payload
- Potential Suspicious File Edit
- Process Spawned from Message-of-the-Day (MOTD)
- rc.local/rc.common File Creation
- Startup/Logon Script added to Group Policy Object
- Suspicious Echo Execution
- Suspicious Echo or Printf Execution Detected via Defend for Containers
- Suspicious Network Activity to the Internet by Previously Unknown Executable
- Suspicious Process Spawned from MOTD Detected
- Suspicious rc.local Error Message
- Suspicious StartupItem Plist Creation
- System V Init (init.d) Executed Binary from Unusual Location
- System V Init Script Created
- Systemd-udevd Rule File Creation
- Udev Execution Followed by Egress Network Connection
- Uncommon Registry Persistence Change
- Unusual Azure VM Extension Detected
- Unusual Exim4 Child Process
- Unusual SSH Parent/Child Execution
Splunk 10 rules
- Linux File Creation In Init Boot Directory
- Linux File Creation In System Generator Directory
- Linux MOTD Script Added
- Linux Suspicious XDG Autostart
- Linux UDEV Rule Created
- Logon Script Event Trigger Execution
- Logon Script Registry Key added (PowerShell)
- Logon Script Registry Key added (Sysmon)
- Logon Script Registry Key added (Windows Event Log)
- MacOS LoginHook Persistence