Detect Boot or Logon Initialization Scripts in Elastic Security
Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. On Windows, logon scripts can be set via the UserInitMprLogonScript registry value under HKCU\Environment, or via Group Policy. On Linux and macOS, adversaries target RC scripts (/etc/rc.d/, /etc/init.d/, /etc/rc.local), systemd unit files, login hooks, and startup items. These mechanisms execute with elevated privileges and survive reboots, making them effective persistence mechanisms. Threat groups including APT41, APT29, Rocke, and UNC3886 have all leveraged initialization script abuse, targeting both enterprise endpoints and network appliances.
MITRE ATT&CK
- Tactic
- Persistence Privilege Escalation
- Canonical reference
- https://attack.mitre.org/techniques/T1037/
Elastic Detection Query
any where
(
// Branch 1: Windows registry-based logon script persistence
(event.category == "registry" and event.type in ("creation", "change") and
registry.path : ("*\\Environment\\UserInitMprLogonScript*", "*UserInitMprLogonScript*"))
or
// Branch 2: Script file written to Windows Group Policy / SYSVOL / netlogon paths
(event.category == "file" and event.type in ("creation", "change") and
file.path : ("*\\GroupPolicy\\*", "*\\SYSVOL\\*", "*\\netlogon\\*") and
file.extension in ("bat", "cmd", "vbs", "ps1", "js", "wsf"))
or
// Branch 3: Linux init script file creation or modification
(event.category == "file" and event.type in ("creation", "change") and
file.path : ("/etc/rc.d/*", "/etc/init.d/*", "/etc/rc.local", "/etc/init/*",
"/etc/rc0.d/*", "/etc/rc1.d/*", "/etc/rc2.d/*", "/etc/rc3.d/*",
"/etc/rc4.d/*", "/etc/rc5.d/*", "/etc/rc6.d/*"))
or
// Branch 4: macOS login hook configured via defaults write
(event.category == "process" and event.type == "start" and
process.name == "defaults" and
process.args : ("*LoginHook*", "*LogoutHook*"))
)Detects T1037 Boot or Logon Initialization Script persistence across Windows, Linux, and macOS. Covers four detection branches: (1) Windows registry modification of UserInitMprLogonScript under HKCU\Environment, (2) script file writes into GroupPolicy/SYSVOL/netlogon directories, (3) file creation or modification in Linux RC/init.d paths, and (4) macOS login hook configuration via the 'defaults write' command. Uses Elastic Common Schema event categories for cross-platform coverage.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate IT administrators setting domain logon scripts via Group Policy Object (GPO) management consoles — UserInitMprLogonScript modifications from known admin hosts should be baselined and excluded.
- Configuration management platforms (Ansible, Puppet, Chef, SaltStack) that modify /etc/init.d/ or /etc/rc.d/ scripts as part of automated service deployments on Linux systems.
- macOS MDM solutions such as Jamf Pro or Mosyle that configure login hooks or logout hooks for endpoint management, software deployment, or compliance enforcement.
Other platforms for T1037
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Windows Logon Script via UserInitMprLogonScript Registry
Expected signal: Sysmon Event ID 13 (Registry Value Set): TargetObject=HKCU\Environment\UserInitMprLogonScript, Details=%TEMP%\argus-test-logon.bat, Image=reg.exe. Sysmon Event ID 11 (File Create): TargetFilename=%TEMP%\argus-test-logon.bat. DeviceRegistryEvents in MDE will show ActionType=RegistryValueSet with RegistryValueName=UserInitMprLogonScript.
- Test 2Linux RC Script Persistence via init.d
Expected signal: Linux auditd SYSCALL=openat/write with name=/etc/init.d/argus-test and exe=bash or exe=tee. Syslog entries for update-rc.d execution. If auditd rule -w /etc/init.d -p wa -k init_script_write is in place, ausearch will return the creation event with auid, uid, pid, and full command context. File creation timestamp visible via stat /etc/init.d/argus-test.
- Test 3macOS Login Hook Configuration
Expected signal: Sysmon for macOS Event ID 1 (Process Create): Image=defaults, CommandLine contains 'write com.apple.loginwindow LoginHook'. File create event for /tmp/argus-loginhook.sh. MDE DeviceProcessEvents will show FileName=defaults with ProcessCommandLine referencing LoginHook. On execution at next login: launchd spawning the hook script as parent.
- Test 4Windows Network Logon Script via Group Policy INI
Expected signal: Sysmon Event ID 11 (File Create): TargetFilename in %SYSTEMROOT%\System32\GroupPolicy\User\Scripts\Logon\ with .bat extension. DeviceFileEvents ActionType=FileCreated for both the script and scripts.ini. Security Event ID 4688 (cmd.exe executing mkdir and echo). On next logon: userinit.exe spawning the script from the GroupPolicy Scripts directory.
References (10)
- https://attack.mitre.org/techniques/T1037/
- https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang
- https://www.mandiant.com/resources/blog/unc3524-eye-spy-email
- https://blog.netlab.360.com/rotajakiro-a-long-live-secret-backdoor-with-a-suspicious-connection-to-oa-system/
- https://www.mandiant.com/resources/blog/esxi-hypervisors-malware-persistence
- https://support.apple.com/guide/deployment/use-login-and-logout-hooks-dep07b92494/web
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/bb742376(v=technet.10)
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1037/T1037.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/linux/file_event
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688
Unlock Pro Content
Get the full detection package for T1037 including response playbook, investigation guide, and atomic red team tests.