Detect Boot or Logon Initialization Scripts in Splunk
Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. On Windows, logon scripts can be set via the UserInitMprLogonScript registry value under HKCU\Environment, or via Group Policy. On Linux and macOS, adversaries target RC scripts (/etc/rc.d/, /etc/init.d/, /etc/rc.local), systemd unit files, login hooks, and startup items. These mechanisms execute with elevated privileges and survive reboots, making them effective persistence mechanisms. Threat groups including APT41, APT29, Rocke, and UNC3886 have all leveraged initialization script abuse, targeting both enterprise endpoints and network appliances.
MITRE ATT&CK
- Tactic
- Persistence Privilege Escalation
- Canonical reference
- https://attack.mitre.org/techniques/T1037/
SPL Detection Query
| union
[
search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
| eval TargetObject=coalesce(TargetObject, RegistryPath)
| where match(TargetObject, "(?i)\\Environment\\UserInitMprLogonScript")
| eval DetectionBranch="Windows-LogonScript-Registry"
| eval Detail=TargetObject
| table _time, host, User, TargetObject, Details, Image, CommandLine, DetectionBranch, Detail
]
[
search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| where match(TargetFilename, "(?i)(\\\\GroupPolicy\\\\|\\\\SYSVOL\\\\|\\\\netlogon\\\\)")
AND match(TargetFilename, "(?i)\.(bat|cmd|vbs|ps1|js|wsf)$")
| eval DetectionBranch="Windows-StartupScript-FileCreate"
| eval Detail=TargetFilename
| table _time, host, User, TargetFilename, Image, CommandLine, DetectionBranch, Detail
]
[
search index=linux sourcetype=syslog
("init.d" OR "rc.local" OR "rc.d" OR "/etc/init/")
("chmod" OR "cp" OR "mv" OR "echo" OR "tee" OR "install")
| rex field=_raw "(?P<action>chmod|cp|mv|echo|tee|install)\s+.*(?P<path>/etc/(rc\.d|init\.d|init|rc\.local)[^\s]*)"
| where isnotnull(path)
| eval DetectionBranch="Linux-InitScript-Activity"
| eval Detail=path
| table _time, host, path, action, _raw, DetectionBranch, Detail
]
[
search index=linux sourcetype="linux_auditd"
(key="persistence" OR syscall=rename OR syscall=write OR syscall=open)
(name="/etc/init.d*" OR name="/etc/rc.d*" OR name="/etc/rc.local" OR name="/etc/init/*")
| eval DetectionBranch="Linux-AuditD-InitScript"
| eval Detail=name
| table _time, host, auid, uid, name, syscall, exe, DetectionBranch, Detail
]
[
search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
Image="*/defaults" CommandLine="*LoginHook*"
| eval DetectionBranch="macOS-LoginHook-Configured"
| eval Detail=CommandLine
| table _time, host, User, Image, CommandLine, ParentImage, DetectionBranch, Detail
]
| sort - _timeDetects Boot or Logon Initialization Script abuse using Sysmon and Linux telemetry across four branches: (1) Sysmon Event ID 13 (Registry Value Set) targeting the UserInitMprLogonScript registry key used for Windows per-user logon scripts; (2) Sysmon Event ID 11 (File Create) detecting script drops in GroupPolicy, SYSVOL, and NETLOGON directories; (3) Linux syslog analysis for commands writing to /etc/init.d/ and related RC directories; (4) Linux auditd records for file write syscalls targeting init script paths; and (5) macOS defaults command used to configure LoginHook or LogoutHook persistence.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Group Policy administrators deploying legitimate logon scripts via SYSVOL/NETLOGON shares during policy updates
- Configuration management tools (Ansible, Chef, Puppet, SCCM) writing startup scripts to managed endpoints as part of authorized deployments
- Linux package managers (apt, yum, dnf, rpm) creating init.d service scripts when installing server software
- System administrators manually configuring logon scripts for mapped drives, printer connections, or environment variable setup
- macOS enterprise MDM solutions (Jamf, Mosyle) configuring LoginHooks for device enrollment or management tasks
Other platforms for T1037
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Windows Logon Script via UserInitMprLogonScript Registry
Expected signal: Sysmon Event ID 13 (Registry Value Set): TargetObject=HKCU\Environment\UserInitMprLogonScript, Details=%TEMP%\argus-test-logon.bat, Image=reg.exe. Sysmon Event ID 11 (File Create): TargetFilename=%TEMP%\argus-test-logon.bat. DeviceRegistryEvents in MDE will show ActionType=RegistryValueSet with RegistryValueName=UserInitMprLogonScript.
- Test 2Linux RC Script Persistence via init.d
Expected signal: Linux auditd SYSCALL=openat/write with name=/etc/init.d/argus-test and exe=bash or exe=tee. Syslog entries for update-rc.d execution. If auditd rule -w /etc/init.d -p wa -k init_script_write is in place, ausearch will return the creation event with auid, uid, pid, and full command context. File creation timestamp visible via stat /etc/init.d/argus-test.
- Test 3macOS Login Hook Configuration
Expected signal: Sysmon for macOS Event ID 1 (Process Create): Image=defaults, CommandLine contains 'write com.apple.loginwindow LoginHook'. File create event for /tmp/argus-loginhook.sh. MDE DeviceProcessEvents will show FileName=defaults with ProcessCommandLine referencing LoginHook. On execution at next login: launchd spawning the hook script as parent.
- Test 4Windows Network Logon Script via Group Policy INI
Expected signal: Sysmon Event ID 11 (File Create): TargetFilename in %SYSTEMROOT%\System32\GroupPolicy\User\Scripts\Logon\ with .bat extension. DeviceFileEvents ActionType=FileCreated for both the script and scripts.ini. Security Event ID 4688 (cmd.exe executing mkdir and echo). On next logon: userinit.exe spawning the script from the GroupPolicy Scripts directory.
References (10)
- https://attack.mitre.org/techniques/T1037/
- https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang
- https://www.mandiant.com/resources/blog/unc3524-eye-spy-email
- https://blog.netlab.360.com/rotajakiro-a-long-live-secret-backdoor-with-a-suspicious-connection-to-oa-system/
- https://www.mandiant.com/resources/blog/esxi-hypervisors-malware-persistence
- https://support.apple.com/guide/deployment/use-login-and-logout-hooks-dep07b92494/web
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/bb742376(v=technet.10)
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1037/T1037.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/linux/file_event
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688
Unlock Pro Content
Get the full detection package for T1037 including response playbook, investigation guide, and atomic red team tests.