MITRE ATT&CK technique · Persistence, Privilege Escalation

`T1037` Boot or Logon Initialization Scripts

Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.(Citation: Mandiant APT29 Eye Spy Email Nov 22)(Citation: Anomali Rocke March 2019) Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

CyclopsBlink

Sigma rules to hunt it

Potential Persistence Via Logon Scripts - CommandLinehightest · windows
Uncommon Userinit Child Processhightest · windows
Potential Persistence Via Logon Scripts - Registrymediumtest · windows

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.