tfMITRE ATT&CK technique

Boot or Logon Initialization Scripts T1037

Tactics: Persistence, Privilege Escalation
Platforms: ESXi, Linux, macOS, Network Devices, Windows
Version: 2.4
Created: 31 May 2017
Last modified: 12 May 2026

Sub-techniques 511 rules across the family · 3 mapped directly to T1037 · 4 of 5 carry rules

.001Logon Script (Windows)4 .002Login Hook1 .003Network Logon Script0 .004RC Scripts1 .005Startup Items2

Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.[1][2] Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups70th pct

Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware57th pct

Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules54th pct

Detection rules54th percentile · 54% of ATT&CK techniques have this many detection rules written or fewer.

Boot or Logon Initialization Scripts MITRE reference T1037

70th pctamong all ATT&CK techniques for number of groups

4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

UNC3886G1048 ↗

Has attempted to bypass digital signature verification checks at startup by adding a command to the startup config /etc/init.d/localnet within the rootfs.gz archive of both FortiManager and FortiAnalyzer devices.1

created 2025-05-291 reference

RockeG0106 ↗

Has installed an "init.d" startup script to maintain persistence.1

created 2020-05-261 reference

APT41G0096 ↗

Used a hidden shell script in /etc/rc.d/init.d to leverage the ADORE.XSECbackdoor and Adore-NG rootkit.1

created 2019-09-231 referenceaka Wicked Panda

APT29G0016 ↗

Has hijacked legitimate application-specific startup scripts to enable malware to execute on system startup.1

created 2017-05-311 referenceaka IRON RITUAL

All 4 groups for this technique

3 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

SPAWNCHIMERAS9024 ↗

Has modified the boot process files within /tmp/coreboot_fs/bin/init to establish persistence.1

created 2026-04-17MALWARE

VIRTUALPITAS1217 ↗

Can persist as an init.d startup service on Linux vCenter systems.1

created 2025-06-02MALWAREcarried by 1 group

RotaJakiroS1078 ↗

Depending on the Linux distribution and when executing with root permissions, RotaJakiro may install persistence using a .conf file in the /etc/init/ folder.1

created 2023-06-14MALWAREcarried by 1 group

All 3 software entries for this technique

Offense vs defense T1037

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 3

first rule: 2026 Q3 · 1 of 1 campaigns plotted

Boot or Logon Initialization Scripts detection strategy DET0112

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Boot or Logon Initialization Scripts Detection Strategy

Enterprise

5 platforms

AN0311 · Windows

Monitoring modification and execution of user or system logon scripts such as in registry Run keys or startup folders.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Scheduled Job CreationDC0001	WinEventLog:TaskScheduler	EventCode=106
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Windows Registry Key ModificationDC0063	WinEventLog:Security	EventCode=4657

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TargetObject	Registry path that may vary by user or policy configuration.
ParentProcessName	Can be tuned to known parent processes to reduce false positives.
TimeWindow	Logon activity clustered during specific user shifts.

AN0312 · Linux

Detection of changes or execution of shell initialization scripts like .bashrc, .profile, or /etc/profile for persistence.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	EXECVE
File MetadataDC0059	auditd:PATH	PATH
File ModificationDC0061	linux:osquery	file_events

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
FilePath	Initialization script path that can differ across user and system profiles.
UserContext	User-level vs root-level configuration.
TimeWindow	Useful to correlate between file change and subsequent execution.

AN0313 · macOS

Monitoring for modification and execution of login hook scripts or LaunchAgents/LaunchDaemons used for persistence.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Script ExecutionDC0029	macos:unifiedlog	log
Service MetadataDC0041	macos:osquery	launchd
File AccessDC0055	fs:fsusage	file

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
Label	LaunchAgent or LaunchDaemon label name, often environment-specific.
ProgramArguments	Arguments passed to scripts, which may need tuning by environment.
UserContext	Distinguish between user login and system startup agents.

AN0314 · ESXi

Detection of modification to ESXi rc.local.d or rc scripts that are used to execute on boot.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Script ExecutionDC0029	esxi:vmkernel	boot
File ModificationDC0061	esxi:hostd	boot

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ScriptName	Script path or name may vary across hypervisor versions.
LogSeverity	Log verbosity settings may alter visibility of activity.

AN0315 · Network Devices

Detection of changes to device startup-config files that include boot scripts or scheduled execution routines.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File ModificationDC0061	networkdevice:syslog	config

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
Interface	Affected interface or subsystem; varies per device.
CommandPattern	Patterns of authorized config changes differ by vendor or policy.

Boot or Logon Initialization Scripts detections T1037

3 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

54th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs