UNC3886G1048 ↗
Has attempted to bypass digital signature verification checks at startup by adding a command to the startup config /etc/init.d/localnet within the rootfs.gz archive of both FortiManager and FortiAnalyzer devices.1
tfMITRE ATT&CK technique
Boot or Logon Initialization Scripts T1037
- Tactics
- Persistence, Privilege Escalation
- Platforms
- ESXi, Linux, macOS, Network Devices, Windows
- Version
- 2.4
- Created
- 31 May 2017
- Last modified
- 12 May 2026
Sub-techniques 511 rules across the family · 3 mapped directly to T1037 · 4 of 5 carry rules
Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.[1][2] Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
4
Threat groups70th pct
Threat groups70th percentile · 64% of ATT&CK techniques have fewer threat groups attributed.1
Campaigns72nd pct
Campaigns72nd percentile · 54% of ATT&CK techniques have fewer campaigns recorded.3
Tools & malware57th pct
Tools & malware57th percentile · 51% of ATT&CK techniques have fewer tools implementing them.3
Detection rules54th pct
Detection rules54th percentile · 49% of ATT&CK techniques have fewer detection rules written.