1. Home
  2. ATT&CK Techniques
  3. T1037 Boot or Logon Initialization Scripts

T1037 Boot or Logon Initialization Scripts

Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.(Citation: Mandiant APT29 Eye Spy Email Nov 22)(Citation: Anomali Rocke March 2019) Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely.

Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.

An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
PR.AA-05.01 Access privilege limitation Mitigates T1037 Boot or Logon Initialization Scripts
Comments
This diagnostic statement describes the implementation of least privilege principle, which can be applied to limiting permissions through role-based access controls, file and directory permissions, and the execution of systems and services. Ensure proper permissions are set for Registry hives to prevent users from modifying keys for logon scripts that may lead to persistence.
References

    NIST 800-53 Mappings

    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
    CA-07 Continuous Monitoring mitigates T1037 Boot or Logon Initialization Scripts
    CM-06 Configuration Settings mitigates T1037 Boot or Logon Initialization Scripts
    AC-17 Remote Access mitigates T1037 Boot or Logon Initialization Scripts
    SI-03 Malicious Code Protection mitigates T1037 Boot or Logon Initialization Scripts
    SI-07 Software, Firmware, and Information Integrity mitigates T1037 Boot or Logon Initialization Scripts
    CM-02 Baseline Configuration mitigates T1037 Boot or Logon Initialization Scripts
    CM-07 Least Functionality mitigates T1037 Boot or Logon Initialization Scripts
    SI-04 System Monitoring mitigates T1037 Boot or Logon Initialization Scripts
    AC-03 Access Enforcement mitigates T1037 Boot or Logon Initialization Scripts

    VERIS Mappings

    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
    action.hacking.variety.Backdoor Hacking action that creates a backdoor for use. related-to T1037 Boot or Logon Initialization Scripts
    action.hacking.vector.Backdoor Hacking actions taken through a backdoor. C2 is only used by malware. related-to T1037 Boot or Logon Initialization Scripts
    action.malware.variety.Backdoor Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'. related-to T1037 Boot or Logon Initialization Scripts
    attribute.integrity.variety.Modify configuration Modified configuration or services related-to T1037 Boot or Logon Initialization Scripts

    Azure Mappings

    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
    file_integrity_monitoring Microsoft Defender for Cloud: File Integrity Monitoring technique_scores T1037 Boot or Logon Initialization Scripts
    Comments
    This control can detect abuse of boot or logon initialization scripts.
    References
    1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview

    GCP Mappings

    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
    google_secops Google Security Operations technique_scores T1037 Boot or Logon Initialization Scripts
    Comments
    Google Security Ops is able to trigger an alert based on registry modifications related to custom logon scripts. (e.g., "REGISTRY_CREATION", ""REGISTRY_MODIFICATION", "HKCU|HKEY_CURRENT_USER"). This technique was scored as minimal based on low or uncertain detection coverage factor. https://github.com/chronicle/detection-rules/blob/783e0e5947774785db1c55041b70176deeca6f46/mitre_attack/T1547_001_windows_registry_run_keys_startup_folder.yaral
    References
    1. ['https://cloud.google.com/security/products/security-operations'
    2. 'https://cloud.google.com/chronicle/docs/secops/secops-overview'
    3. 'https://github.com/chronicle/detection-rules']

    AWS Mappings

    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
    amazon_inspector Amazon Inspector technique_scores T1037 Boot or Logon Initialization Scripts
    Comments
    The Amazon Inspector Best Practices assessment package can assess security control "Configure permissions for system directories" that prevents privilege escalation by local users and ensures only the root account can modify/execute system configuration information and binaries. Amazon Inspector does not directly protect against system modifications rather it just checks to see if security controls are in place which can inform decisions around hardening the system. Furthermore, Amazon Inspector only supports a subset of the sub-techniques for this technique. Due to these things and the fact the security control is only supported for Linux platforms, the score is Minimal.
    References
    1. https://docs.aws.amazon.com/inspector/latest/userguide/inspector_introduction.html

    ATT&CK Subtechniques

    Technique ID Technique Name Number of Mappings
    T1037.002 Login Hook 8
    T1037.005 Startup Items 8
    T1037.003 Network Logon Script 10
    T1037.004 RC Scripts 9
    T1037.001 Logon Script (Windows) 5