Skip to content

T1037 Boot or Logon Initialization Scripts

Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.21 Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely.

Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.

An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.

Item Value
ID T1037
Sub-techniques T1037.001, T1037.002, T1037.003, T1037.004, T1037.005
Tactics TA0003, TA0004
Platforms ESXi, Linux, Network Devices, Windows, macOS
Version 2.4
Created 31 May 2017
Last Modified 24 October 2025

Procedure Examples

ID Name Description
G0016 APT29 APT29 has hijacked legitimate application-specific startup scripts to enable malware to execute on system startup.2
G0096 APT41 APT41 used a hidden shell script in /etc/rc.d/init.d to leverage the ADORE.XSECbackdoor and Adore-NG rootkit.5
C0046 ArcaneDoor ArcaneDoor used malicious boot scripts to install the Line Runner backdoor on victim devices.7
G0106 Rocke Rocke has installed an “init.d” startup script to maintain persistence.1
S1078 RotaJakiro Depending on the Linux distribution and when executing with root permissions, RotaJakiro may install persistence using a .conf file in the /etc/init/ folder.3
G1048 UNC3886 UNC3886 has attempted to bypass digital signature verification checks at startup by adding a command to the startup config /etc/init.d/localnet within the rootfs.gz archive of both FortiManager and FortiAnalyzer devices.6
S1217 VIRTUALPITA VIRTUALPITA can persist as an init.d startup service on Linux vCenter systems.4

Mitigations

ID Mitigation Description
M1022 Restrict File and Directory Permissions Restrict write access to logon scripts to specific administrators.
M1024 Restrict Registry Permissions Ensure proper permissions are set for Registry hives to prevent users from modifying keys for logon scripts that may lead to persistence.

References

  1. Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019. ↩↩

  2. Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023. ↩↩

  3. Alex Turing, Hui Wang. (2021, April 28). RotaJakiro: A long live secret backdoor with 0 VT detection. Retrieved June 14, 2023. ↩

  4. Alexander Marvi, Jeremy Koppen, Tufail Ahmed, and Jonathan Lepore. (2022, September 29). Bad VIB(E)s Part One: Investigating Novel Malware Persistence Within ESXi Hypervisors. Retrieved March 26, 2025. ↩

  5. Mandiant. (n.d.). APT41, A DUAL ESPIONAGE AND CYBER CRIME OPERATION. Retrieved June 11, 2024. ↩

  6. Marvi, A. et al.. (2023, March 16). Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation. Retrieved March 22, 2023. ↩

  7. Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025. ↩