tfMITRE ATT&CK sub-technique

RC Scripts T1037.004

sub-technique of T1037 Boot or Logon Initialization Scripts

Tactics: Persistence, Privilege Escalation
Platforms: macOS, Linux, Network Devices, ESXi
Version: 2.2
Created: 15 January 2020
Last modified: 24 October 2025

Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware62nd pct

Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules42nd pct

Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.

RC Scripts MITRE reference T1037.004

64th pctamong all ATT&CK techniques for number of groups

3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

UNC3886G1048 ↗

Has placed a bash installation script into /etc/rc.local.d/ to establish persistence.1

created 2025-05-291 reference

Velvet AntG1047 ↗

Used a modified /etc/rc.local file on compromised F5 BIG-IP devices to maintain persistence.1

created 2025-03-141 reference

APT29G0016 ↗

Has installed a run command on a compromised system to enable malware execution on system startup.1

created 2017-05-311 referenceaka IRON RITUAL

All 3 groups for this technique

4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

Green LambertS0690 ↗

Can add init.d and rc.d files in the /etc folder to establish persistence.1 2

created 2022-03-21MALWARE

Cyclops BlinkS0687 ↗

Has the ability to execute on device startup, using a modified RC script named S51armled.1

created 2022-03-03MALWAREcarried by 1 group

HiddenWaspS0394 ↗

Installs reboot persistence by adding itself to /etc/rc.local.1

created 2019-06-24MALWARE

iKittenS0278 ↗

Adds an entry to the rc.common file for persistence.1

created 2018-10-17MALWARE

All 4 software entries for this technique

Offense vs defense T1037.004

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 1

first rule: 2021 Q4

RC Scripts detection strategy DET0237

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Boot or Logon Initialization Scripts: RC Scripts

Enterprise

4 platforms

AN0658 · Linux

Detection of modified or newly created /etc/rc.local or /etc/init.d scripts followed by suspicious execution during system startup.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Script ExecutionDC0029	linux:syslog	boot logs
Process CreationDC0032	auditd:SYSCALL	execve

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
script_path	Specific path of init script (e.g., /etc/rc.local, /etc/init.d/*) may vary by distribution
user_context	Root vs. non-root modification context depending on configuration
time_window	Tuning window for script creation or modification relative to system boot

AN0659 · macOS

Detection of edits or additions to /etc/rc.common, /Library/StartupItems, or /System/Library/StartupItems and associated script execution during login or reboot.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	process events
File CreationDC0039	fs:fsusage	file activity

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
script_name	Name of script or LaunchDaemon plist is tunable across environments
event_interval	Time window between modification and reboot/login
file_permission	Permissions on modified RC files can vary between systems

AN0660 · ESXi

Detection of changes to /etc/rc.local.d/local.sh or rc.local during post-boot script execution with abnormal commands or additions.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File ModificationDC0061	esxi:shell	admin command usage
Command ExecutionDC0064	esxi:syslog	boot logs

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
script_section	Tunable script section edited by adversary (beginning, end, inline)
command_type	Nature of embedded command or payload affects detection scope
execution_trigger	Boot vs. manual script re-invocation

AN0661 · Network Devices

Detection of modified boot-time configuration scripts that persist malicious CLI commands across reboots.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File ModificationDC0061	networkdevice:syslog	startup-config
Command ExecutionDC0064	networkdevice:syslog	system boot logs

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
firmware_family	Device type or OS determines specific init script location
config_line_pattern	Regex or pattern matching approach to detect suspicious CLI
reboot_time_window	Time window between config change and first boot post-modification

Restrict File and Directory PermissionsM1022

Limit privileges of user accounts so only authorized users can edit the rc.common file.

Tests3Executorsbash 2 · sh 1Need elevation3 of 3Have prerequisites0Have cleanup2Platformsmacos, linux

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup
01	rc.common	macos	bash	Required	—	—
Modify rc.common Reference Attack command sudo echo osascript -e 'tell app "Finder" to display dialog "Hello World"' >> /etc/rc.common GUID165a5909-b8bd-43ed-a9d8-7c8e8f2ce03c
02	rc.common	linux	bash	Required	—	Yes
Modify rc.common Attack command filename='/etc/rc.common';if [ ! -f $filename ];then sudo touch $filename;else sudo cp $filename /etc/rc.common.original;fi printf '%s\n' '#!/bin/bash' \| sudo tee /etc/rc.common echo "python3 -c \"import os, base64;exec(base64.b64decode('aW1wb3J0IG9zCm9zLnBvcGVuKCdlY2hvIGF0b21pYyB0ZXN0IGZvciBtb2RpZnlpbmcgcmMuY29tbW9uID4gL3RtcC9UMTAzNy4wMDQucmMuY29tbW9uJykK'))\"" \| sudo tee -a /etc/rc.common printf '%s\n' 'exit 0' \| sudo tee -a /etc/rc.common sudo chmod +x /etc/rc.common Cleanup command origfilename='/etc/rc.common.original';if [ ! -f $origfilename ];then sudo rm /etc/rc.common;else sudo cp $origfilename /etc/rc.common && sudo rm $origfilename;fi GUID816c522d-11d7-441d-8286-6392e534ebc1
03	rc.local	linux	sh	Required	—	Yes
Modify rc.local Attack command filename='/etc/rc.local';if [ ! -f $filename ];then sudo touch $filename;else sudo cp $filename /etc/rc.local.original;fi [ "$(uname)" = 'FreeBSD' ] && alias python3=python3.9 && printf '#\!/usr/local/bin/bash' \| sudo tee /etc/rc.local \|\| printf '#!/bin/bash' \| sudo tee /etc/rc.local echo "\npython3 -c \"import os, base64;exec(base64.b64decode('aW1wb3J0IG9zCm9zLnBvcGVuKCdlY2hvIGF0b21pYyB0ZXN0IGZvciBtb2RpZnlpbmcgcmMubG9jYWwgPiAvdG1wL1QxMDM3LjAwNC5yYy5sb2NhbCcpCgo='))\"" \| sudo tee -a /etc/rc.local printf 'exit 0' \| sudo tee -a /etc/rc.local sudo chmod +x /etc/rc.local Cleanup command origfilename='/etc/rc.local.original';if [ ! -f $origfilename ];then sudo rm /etc/rc.local;else sudo cp $origfilename /etc/rc.local && sudo rm $origfilename;fi GUID349e4ee3-3e58-4c99-b670-1c9ed2ba1841

Tests from Atomic Red Team (MIT licence) · technique definition

RC Scripts detections T1037.004

1 rule is mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

42nd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs