MITRE ATT&CK technique · Persistence, Privilege Escalation

`T1037.004` RC Scripts

Sub-technique of T1037 Boot or Logon Initialization Scripts

Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify. Adversaries may establish persistence by adding a malicious binary path or shell commands to rc.local, rc.common, and other…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

CyclopsBlink

Sigma rules to hunt it

SigmaHQ has no rules for this technique.

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.