Detect Boot or Logon Initialization Scripts in CrowdStrike LogScale
Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. On Windows, logon scripts can be set via the UserInitMprLogonScript registry value under HKCU\Environment, or via Group Policy. On Linux and macOS, adversaries target RC scripts (/etc/rc.d/, /etc/init.d/, /etc/rc.local), systemd unit files, login hooks, and startup items. These mechanisms execute with elevated privileges and survive reboots, making them effective persistence mechanisms. Threat groups including APT41, APT29, Rocke, and UNC3886 have all leveraged initialization script abuse, targeting both enterprise endpoints and network appliances.
MITRE ATT&CK
- Tactic
- Persistence Privilege Escalation
- Canonical reference
- https://attack.mitre.org/techniques/T1037/
LogScale Detection Query
// T1037 - Boot or Logon Initialization Scripts
// Detect Windows registry logon script, startup script file drops, Linux init script writes, and macOS login hook config
#event_simpleName in (RegGenericValueUpdate, RegGenericKeyCreate, RegValueUpdate, FileWritten, PeFileWritten, ProcessRollup2)
| case {
// Branch 1: Windows registry logon script - UserInitMprLogonScript
#event_simpleName in (RegGenericValueUpdate, RegGenericKeyCreate, RegValueUpdate)
| regex(field=RegObjectName, regex="(?i)\\\\Environment\\\\UserInitMprLogonScript", strict=false)
| eval DetectionBranch="Windows-LogonScript-Registry"
| eval Indicator=RegObjectName ;
// Branch 2: Script file written to GroupPolicy / SYSVOL / netlogon
#event_simpleName in (FileWritten, PeFileWritten)
| regex(field=TargetFileName, regex="(?i)(\\\\GroupPolicy\\\\|\\\\SYSVOL\\\\|\\\\netlogon\\\\)", strict=false)
| regex(field=TargetFileName, regex="(?i)\.(bat|cmd|vbs|ps1|js|wsf)$", strict=false)
| eval DetectionBranch="Windows-StartupScript-FileCreate"
| eval Indicator=TargetFileName ;
// Branch 3: Linux init/rc script file written
#event_simpleName in (FileWritten)
| regex(field=TargetFileName, regex="(?i)/etc/(rc\.d|init\.d|rc\.local|init/|rc[0-6]\.d)/", strict=false)
| eval DetectionBranch="Linux-InitScript-FileWrite"
| eval Indicator=TargetFileName ;
// Branch 4: macOS defaults write LoginHook / LogoutHook
#event_simpleName = ProcessRollup2
| regex(field=ImageFileName, regex="(?i)(/usr/bin/defaults|/bin/defaults)$", strict=false)
| regex(field=CommandLine, regex="(?i)(LoginHook|LogoutHook)", strict=false)
| eval DetectionBranch="macOS-LoginHook-Configured"
| eval Indicator=CommandLine ;
// Exclude non-matching events
*
| eval DetectionBranch="_no_match"
}
| DetectionBranch != "_no_match"
| eval Actor=coalesce(UserName, UID, "unknown")
| eval Host=coalesce(ComputerName, aip, "unknown")
| table([timestamp, Host, Actor, DetectionBranch, #event_simpleName, Indicator, ImageFileName, CommandLine, ParentBaseFileName])
| sort(timestamp, order=desc)CrowdStrike LogScale (Falcon) CQL query detecting T1037 Boot or Logon Initialization Script persistence. Uses Falcon telemetry event types: RegGenericValueUpdate/RegGenericKeyCreate/RegValueUpdate for Windows registry logon script (UserInitMprLogonScript), FileWritten/PeFileWritten for script drops into GroupPolicy/SYSVOL/netlogon directories and Linux init.d/rc.d paths, and ProcessRollup2 for macOS login hook configuration via 'defaults write'. Outputs a flat table with detection branch, initiating process, host, and indicator for analyst triage. Designed for use with CrowdStrike Falcon endpoint telemetry in LogScale.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate system administrators or Active Directory management tools (ADUC, GPMC, PowerShell RSAT modules) configuring UserInitMprLogonScript for domain users as an authorized policy deployment mechanism — alert volume should be low and restricted to admin workstations.
- Software packaging tools (WiX, InstallShield, Inno Setup) that write PowerShell or batch scripts into GroupPolicy or netlogon paths as part of MSI or software installer deployments in enterprise environments.
- Linux package managers (rpm, dpkg, apt) or configuration management agents (Puppet agent, Chef client) that write or update init scripts in /etc/init.d/ or /etc/rc.d/ as part of automated package installation or system provisioning workflows.
Other platforms for T1037
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Windows Logon Script via UserInitMprLogonScript Registry
Expected signal: Sysmon Event ID 13 (Registry Value Set): TargetObject=HKCU\Environment\UserInitMprLogonScript, Details=%TEMP%\argus-test-logon.bat, Image=reg.exe. Sysmon Event ID 11 (File Create): TargetFilename=%TEMP%\argus-test-logon.bat. DeviceRegistryEvents in MDE will show ActionType=RegistryValueSet with RegistryValueName=UserInitMprLogonScript.
- Test 2Linux RC Script Persistence via init.d
Expected signal: Linux auditd SYSCALL=openat/write with name=/etc/init.d/argus-test and exe=bash or exe=tee. Syslog entries for update-rc.d execution. If auditd rule -w /etc/init.d -p wa -k init_script_write is in place, ausearch will return the creation event with auid, uid, pid, and full command context. File creation timestamp visible via stat /etc/init.d/argus-test.
- Test 3macOS Login Hook Configuration
Expected signal: Sysmon for macOS Event ID 1 (Process Create): Image=defaults, CommandLine contains 'write com.apple.loginwindow LoginHook'. File create event for /tmp/argus-loginhook.sh. MDE DeviceProcessEvents will show FileName=defaults with ProcessCommandLine referencing LoginHook. On execution at next login: launchd spawning the hook script as parent.
- Test 4Windows Network Logon Script via Group Policy INI
Expected signal: Sysmon Event ID 11 (File Create): TargetFilename in %SYSTEMROOT%\System32\GroupPolicy\User\Scripts\Logon\ with .bat extension. DeviceFileEvents ActionType=FileCreated for both the script and scripts.ini. Security Event ID 4688 (cmd.exe executing mkdir and echo). On next logon: userinit.exe spawning the script from the GroupPolicy Scripts directory.
References (10)
- https://attack.mitre.org/techniques/T1037/
- https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang
- https://www.mandiant.com/resources/blog/unc3524-eye-spy-email
- https://blog.netlab.360.com/rotajakiro-a-long-live-secret-backdoor-with-a-suspicious-connection-to-oa-system/
- https://www.mandiant.com/resources/blog/esxi-hypervisors-malware-persistence
- https://support.apple.com/guide/deployment/use-login-and-logout-hooks-dep07b92494/web
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/bb742376(v=technet.10)
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1037/T1037.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/linux/file_event
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688
Unlock Pro Content
Get the full detection package for T1037 including response playbook, investigation guide, and atomic red team tests.