1. Home
  2. ATT&CK Techniques
  3. T1037 Boot or Logon Initialization Scripts

T1037 Boot or Logon Initialization Scripts

Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.(Citation: Mandiant APT29 Eye Spy Email Nov 22)(Citation: Anomali Rocke March 2019) Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely.

Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.

An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
PR.AA-05.01 Access privilege limitation Mitigates T1037 Boot or Logon Initialization Scripts
Comments
This diagnostic statement describes the implementation of least privilege principle, which can be applied to limiting permissions through role-based access controls, file and directory permissions, and the execution of systems and services. Ensure proper permissions are set for Registry hives to prevent users from modifying keys for logon scripts that may lead to persistence.
References

    NIST 800-53 Mappings

    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
    CA-07 Continuous Monitoring mitigates T1037 Boot or Logon Initialization Scripts
    CM-06 Configuration Settings mitigates T1037 Boot or Logon Initialization Scripts
    AC-17 Remote Access mitigates T1037 Boot or Logon Initialization Scripts
    SI-03 Malicious Code Protection mitigates T1037 Boot or Logon Initialization Scripts
    SI-07 Software, Firmware, and Information Integrity mitigates T1037 Boot or Logon Initialization Scripts
    CM-02 Baseline Configuration mitigates T1037 Boot or Logon Initialization Scripts
    CM-07 Least Functionality mitigates T1037 Boot or Logon Initialization Scripts
    SI-04 System Monitoring mitigates T1037 Boot or Logon Initialization Scripts
    AC-03 Access Enforcement mitigates T1037 Boot or Logon Initialization Scripts

    Known Exploited Vulnerabilities Mappings

    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
    CVE-2024-20359 Cisco ASA and FTD Privilege Escalation Vulnerability secondary_impact T1037 Boot or Logon Initialization Scripts
    Comments
    This vulnerability is exploited by an authenticated, local attacker in order to execute arbitrary code with root-level privileges by copying a crafted file to the disk0: file system. This is possible due to improper validation of a file when it is read from system flash memory. This vulnerability is associated with an attack campaign named ArcaneDoor in early 2024. This campaign targeted this vulnerability among others to implant malware, execute commands, and potentially exfiltrate data from compromised devices.
    References
    1. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-persist-rce-FLsNXF4h
    2. https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
    3. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-websrvs-dos-X8gNucD2
    CVE-2024-20353 Cisco ASA and FTD Denial of Service Vulnerability secondary_impact T1037 Boot or Logon Initialization Scripts
    Comments
    This vulnerability is exploited by a remote, unauthenticated attacker by sending a crafted HTTP request to a vulnerable device's web server. This exploitation is possible due to incomplete error checking when parsing HTTP headers. If successfully exploited, it can cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is associated with an attack campaign named ArcaneDoor in early 2024. This campaign targeted this vulnerability among others to implant malware, execute commands, and potentially exfiltrate data from compromised devices.
    References
    1. https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
    2. https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_attacks_event_response
    CVE-2022-41328 Fortinet FortiOS Path Traversal Vulnerability primary_impact T1037 Boot or Logon Initialization Scripts
    Comments
    CVE-2022-41328 is a path traversal vulnerability that allows a privileged attacked to read and write to files on the underlying Linux system via crafted CLI commands. Adversaries have been observed modifying files that establish persistence upon boot. The malicious files provide the adversaries with the capabilities of: data exfiltration, download/write files, remote shell, and discovery of network connections.
    References
    1. https://www.fortinet.com/blog/psirt-blogs/fg-ir-22-369-psirt-analysis

    VERIS Mappings

    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
    action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1037 Boot or Logon Initialization Scripts
    action.hacking.vector.Backdoor Hacking actions taken through a backdoor. C2 is only used by malware. related-to T1037 Boot or Logon Initialization Scripts
    action.malware.variety.Backdoor Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'. related-to T1037 Boot or Logon Initialization Scripts
    attribute.integrity.variety.Modify configuration Modified configuration or services related-to T1037 Boot or Logon Initialization Scripts

    Azure Mappings

    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
    file_integrity_monitoring Microsoft Defender for Cloud: File Integrity Monitoring technique_scores T1037 Boot or Logon Initialization Scripts
    Comments
    This control can detect abuse of boot or logon initialization scripts.
    References
    1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview

    GCP Mappings

    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
    google_secops Google Security Operations technique_scores T1037 Boot or Logon Initialization Scripts
    Comments
    Google Security Ops is able to trigger an alert based on registry modifications related to custom logon scripts. (e.g., "REGISTRY_CREATION", ""REGISTRY_MODIFICATION", "HKCU|HKEY_CURRENT_USER"). This technique was scored as minimal based on low or uncertain detection coverage factor. https://github.com/chronicle/detection-rules/blob/783e0e5947774785db1c55041b70176deeca6f46/mitre_attack/T1547_001_windows_registry_run_keys_startup_folder.yaral
    References
    1. ['https://cloud.google.com/security/products/security-operations'
    2. 'https://cloud.google.com/chronicle/docs/secops/secops-overview'
    3. 'https://github.com/chronicle/detection-rules']

    AWS Mappings

    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
    amazon_inspector Amazon Inspector technique_scores T1037 Boot or Logon Initialization Scripts
    Comments
    The Amazon Inspector Best Practices assessment package can assess security control "Configure permissions for system directories" that prevents privilege escalation by local users and ensures only the root account can modify/execute system configuration information and binaries. Amazon Inspector does not directly protect against system modifications rather it just checks to see if security controls are in place which can inform decisions around hardening the system. Furthermore, Amazon Inspector only supports a subset of the sub-techniques for this technique. Due to these things and the fact the security control is only supported for Linux platforms, the score is Minimal.
    References
    1. https://docs.aws.amazon.com/inspector/latest/userguide/inspector_introduction.html

    ATT&CK Subtechniques

    Technique ID Technique Name Number of Mappings
    T1037.002 Login Hook 8
    T1037.005 Startup Items 8
    T1037.003 Network Logon Script 10
    T1037.004 RC Scripts 9
    T1037.001 Logon Script (Windows) 5