Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.(Citation: Mandiant APT29 Eye Spy Email Nov 22)(Citation: Anomali Rocke March 2019) Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely.
Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| action.hacking.variety.Backdoor | Hacking action that creates a backdoor for use. | related-to | T1037 | Boot or Logon Initialization Scripts | |
| action.hacking.vector.Backdoor | Hacking actions taken through a backdoor. C2 is only used by malware. | related-to | T1037 | Boot or Logon Initialization Scripts | |
| action.malware.variety.Backdoor | Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'. | related-to | T1037 | Boot or Logon Initialization Scripts | |
| action.malware.variety.Backdoor or C2 | Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. | related-to | T1037 | Boot or Logon Initialization Scripts | |
| attribute.integrity.variety.Modify configuration | Modified configuration or services | related-to | T1037 | Boot or Logon Initialization Scripts | |
| amazon_inspector | Amazon Inspector | technique_scores | T1037 | Boot or Logon Initialization Scripts |
Comments
The Amazon Inspector Best Practices assessment package can assess security control "Configure permissions for system directories" that prevents privilege escalation by local users and ensures only the root account can modify/execute system configuration information and binaries. Amazon Inspector does not directly protect against system modifications rather it just checks to see if security controls are in place which can inform decisions around hardening the system. Furthermore, Amazon Inspector only supports a subset of the sub-techniques for this technique. Due to these things and the fact the security control is only supported for Linux platforms, the score is Minimal.
References
|
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1037.002 | Login Hook | 1 |
| T1037.005 | Startup Items | 1 |
| T1037.003 | Network Logon Script | 1 |
| T1037.004 | RC Scripts | 2 |
| T1037.001 | Logon Script (Windows) | 1 |