Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely.
Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name |
|---|---|---|---|---|
| AC-17 | Remote Access | Protects | T1037 | Boot or Logon Initialization Scripts |
| AC-3 | Access Enforcement | Protects | T1037 | Boot or Logon Initialization Scripts |
| CA-7 | Continuous Monitoring | Protects | T1037 | Boot or Logon Initialization Scripts |
| CM-2 | Baseline Configuration | Protects | T1037 | Boot or Logon Initialization Scripts |
| CM-6 | Configuration Settings | Protects | T1037 | Boot or Logon Initialization Scripts |
| CM-7 | Least Functionality | Protects | T1037 | Boot or Logon Initialization Scripts |
| SI-3 | Malicious Code Protection | Protects | T1037 | Boot or Logon Initialization Scripts |
| SI-4 | System Monitoring | Protects | T1037 | Boot or Logon Initialization Scripts |
| SI-7 | Software, Firmware, and Information Integrity | Protects | T1037 | Boot or Logon Initialization Scripts |
| file_integrity_monitoring | File Integrity Monitoring | technique_scores | T1037 | Boot or Logon Initialization Scripts |
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1037.002 | Logon Script (Mac) | 7 |
| T1037.001 | Logon Script (Windows) | 3 |
| T1037.003 | Network Logon Script | 8 |
| T1037.004 | Rc.common | 7 |
| T1037.005 | Startup Items | 7 |