T1037 · Boot or Logon Initialization Scripts

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1037 · Boot or Logon Initialization Scripts · Sunturai

attack-patternenterprise-attackT1037

Boot or Logon Initialization Scripts

attack-pattern--03259939-0b57-482f-8eb5-87c0e0d54334

Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.(Citation: Mandiant APT29 Eye Spy Email Nov 22) (Citation: Anomali Rocke March 2019) Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely. Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.

Created: May 31, 2017, 9:30 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

5 sub-techniques under this technique

Each is its own technique in the catalogue, with its own detections.

34 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Startup/Logon Script added to Group Policy Object	Medium	Elastic detection rules	Oct 8, 2026	Elastic License 2.0
GenAI Process Accessing Sensitive Files	High	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
Unusual Azure VM Extension Detected	Medium	Elastic detection rules	Sep 29, 2026	Elastic License 2.0
Uncommon Registry Persistence Change	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Persistence via Atom Init Script Modification	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious StartupItem Plist Creation	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Persistence via Login Hook	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Persistence via Login or Logout Hook	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Persistence via Folder Action Script	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual Exim4 Child Process	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Systemd-udevd Rule File Creation	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Suspicious File Edit	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
rc.local/rc.common File Creation	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Execution of rc.local Script	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious rc.local Error Message	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Executable Bit Set for Potential Persistence Script	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Process Spawned from Message-of-the-Day (MOTD)	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Message-of-the-Day (MOTD) File Creation	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
System V Init Script Created	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Chkconfig Service Add	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Pod or Container Creation with Suspicious Command-Line	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Network Activity to the Internet by Previously Unknown Executable	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Persistence via File Modification	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Echo or Printf Execution Detected via Defend for Containers	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Modification of Persistence Relevant Files Detected via Defend for Containers	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0

Showing 25 of 34

Filter in the catalogue

External references

mitre-attackT1037Open reference

Anomali Rocke March 2019Open reference

Mandiant APT29 Eye Spy Email Nov 22Open reference

Platforms

ESXiLinuxmacOSNetwork DevicesWindows

Kill chain phases

persistenceprivilege-escalation

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object