Detect Boot or Logon Initialization Scripts in Microsoft Sentinel
Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. On Windows, logon scripts can be set via the UserInitMprLogonScript registry value under HKCU\Environment, or via Group Policy. On Linux and macOS, adversaries target RC scripts (/etc/rc.d/, /etc/init.d/, /etc/rc.local), systemd unit files, login hooks, and startup items. These mechanisms execute with elevated privileges and survive reboots, making them effective persistence mechanisms. Threat groups including APT41, APT29, Rocke, and UNC3886 have all leveraged initialization script abuse, targeting both enterprise endpoints and network appliances.
MITRE ATT&CK
- Tactic
- Persistence Privilege Escalation
- Canonical reference
- https://attack.mitre.org/techniques/T1037/
KQL Detection Query
let WindowsLogonScriptKeys = dynamic([
"UserInitMprLogonScript",
"\\Environment\\UserInitMprLogonScript"
]);
let LinuxInitPaths = dynamic([
"/etc/rc.d/", "/etc/init.d/", "/etc/rc.local", "/etc/init/",
"/etc/rc0.d/", "/etc/rc1.d/", "/etc/rc2.d/", "/etc/rc3.d/",
"/etc/rc4.d/", "/etc/rc5.d/", "/etc/rc6.d/"
]);
let SuspiciousExtensions = dynamic([".sh", ".py", ".pl", ".rb", ".bash"]);
// Branch 1: Windows registry-based logon scripts
let WindowsLogonScript = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where ActionType in ("RegistryValueSet", "RegistryKeyCreated")
| where RegistryKey has "\\Environment" and RegistryValueName =~ "UserInitMprLogonScript"
| extend DetectionBranch = "Windows-LogonScript-Registry"
| extend Detail = strcat("Key: ", RegistryKey, " | Value: ", RegistryValueData)
| project Timestamp, DeviceName, AccountName, ActionType, RegistryKey,
RegistryValueName, RegistryValueData, InitiatingProcessFileName,
InitiatingProcessCommandLine, DetectionBranch, Detail;
// Branch 2: Suspicious file writes into Windows Startup / logon script paths
let WindowsStartupFile = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified")
| where FolderPath has_any (
"\\Windows\\System32\\GroupPolicy",
"\\Windows\\SysWOW64\\GroupPolicy",
"SYSVOL",
"\\netlogon\\"
)
| where FileName has_any (".bat", ".cmd", ".vbs", ".ps1", ".js", ".wsf")
| extend DetectionBranch = "Windows-StartupScript-FileCreate"
| extend Detail = strcat("File: ", FolderPath, "\\", FileName)
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName,
ActionType, RegistryKey="", RegistryValueName="", RegistryValueData="",
InitiatingProcessFileName, InitiatingProcessCommandLine,
DetectionBranch, Detail;
// Branch 3: Linux/macOS init script file creation (via Syslog/AuditLogs)
let LinuxInitScript = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified")
| where FolderPath has_any (LinuxInitPaths)
| extend DetectionBranch = "Linux-InitScript-FileCreate"
| extend Detail = strcat("File: ", FolderPath, "/", FileName)
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName,
ActionType, RegistryKey="", RegistryValueName="", RegistryValueData="",
InitiatingProcessFileName, InitiatingProcessCommandLine,
DetectionBranch, Detail;
// Branch 4: macOS login hook configuration via 'defaults write'
let MacOSLoginHook = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "defaults"
| where ProcessCommandLine has "LoginHook" or ProcessCommandLine has "LogoutHook"
| extend DetectionBranch = "macOS-LoginHook-Configured"
| extend Detail = ProcessCommandLine
| project Timestamp, DeviceName, AccountName,
ActionType="ProcessCreate", RegistryKey="", RegistryValueName="", RegistryValueData="",
InitiatingProcessFileName, InitiatingProcessCommandLine,
DetectionBranch, Detail;
union WindowsLogonScript, WindowsStartupFile, LinuxInitScript, MacOSLoginHook
| sort by Timestamp descDetects Boot or Logon Initialization Script abuse across Windows, Linux, and macOS. Uses four detection branches: (1) Registry modifications to HKCU\Environment\UserInitMprLogonScript for Windows per-user logon scripts; (2) Script file creation in Windows Group Policy and NETLOGON directories used for network logon scripts; (3) File creation in Linux RC and init.d directories targeted by malware like RotaJakiro, Rocke, and VIRTUALPITA; (4) macOS login hook configuration via the 'defaults write' command targeting LoginHook and LogoutHook keys.
Data Sources
Required Tables
False Positives & Tuning
- Group Policy administrators deploying legitimate logon scripts via SYSVOL/NETLOGON shares during policy updates
- Configuration management tools (Ansible, Chef, Puppet, SCCM) writing startup scripts to managed endpoints as part of authorized deployments
- Linux package managers (apt, yum, dnf, rpm) creating init.d service scripts when installing server software (nginx, apache, mysql)
- System administrators manually configuring logon scripts for mapped drives, printer connections, or environment variable setup
- macOS enterprise MDM solutions (Jamf, Mosyle) configuring LoginHooks for device enrollment or management tasks
Other platforms for T1037
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Windows Logon Script via UserInitMprLogonScript Registry
Expected signal: Sysmon Event ID 13 (Registry Value Set): TargetObject=HKCU\Environment\UserInitMprLogonScript, Details=%TEMP%\argus-test-logon.bat, Image=reg.exe. Sysmon Event ID 11 (File Create): TargetFilename=%TEMP%\argus-test-logon.bat. DeviceRegistryEvents in MDE will show ActionType=RegistryValueSet with RegistryValueName=UserInitMprLogonScript.
- Test 2Linux RC Script Persistence via init.d
Expected signal: Linux auditd SYSCALL=openat/write with name=/etc/init.d/argus-test and exe=bash or exe=tee. Syslog entries for update-rc.d execution. If auditd rule -w /etc/init.d -p wa -k init_script_write is in place, ausearch will return the creation event with auid, uid, pid, and full command context. File creation timestamp visible via stat /etc/init.d/argus-test.
- Test 3macOS Login Hook Configuration
Expected signal: Sysmon for macOS Event ID 1 (Process Create): Image=defaults, CommandLine contains 'write com.apple.loginwindow LoginHook'. File create event for /tmp/argus-loginhook.sh. MDE DeviceProcessEvents will show FileName=defaults with ProcessCommandLine referencing LoginHook. On execution at next login: launchd spawning the hook script as parent.
- Test 4Windows Network Logon Script via Group Policy INI
Expected signal: Sysmon Event ID 11 (File Create): TargetFilename in %SYSTEMROOT%\System32\GroupPolicy\User\Scripts\Logon\ with .bat extension. DeviceFileEvents ActionType=FileCreated for both the script and scripts.ini. Security Event ID 4688 (cmd.exe executing mkdir and echo). On next logon: userinit.exe spawning the script from the GroupPolicy Scripts directory.
References (10)
- https://attack.mitre.org/techniques/T1037/
- https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang
- https://www.mandiant.com/resources/blog/unc3524-eye-spy-email
- https://blog.netlab.360.com/rotajakiro-a-long-live-secret-backdoor-with-a-suspicious-connection-to-oa-system/
- https://www.mandiant.com/resources/blog/esxi-hypervisors-malware-persistence
- https://support.apple.com/guide/deployment/use-login-and-logout-hooks-dep07b92494/web
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/bb742376(v=technet.10)
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1037/T1037.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/linux/file_event
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688
Unlock Pro Content
Get the full detection package for T1037 including response playbook, investigation guide, and atomic red team tests.