MITRE ATT&CK technique
Boot or Logon Initialization Scripts detection rulesT1037
Boot or Logon Initialization Scripts (T1037) is a MITRE ATT&CK technique in the Persistence tactic. This page lists the 4 community-maintained Sigma detection rules in the library mapped to T1037 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows, macos.
Tactic
Potential Persistence Via Logon Scripts - CommandLine
highDetects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence
windows · process_creation
Uncommon Userinit Child Process
highDetects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for persistence.
windows · process_creation
Potential Persistence Via Logon Scripts - Registry
mediumDetects creation of "UserInitMprLogonScript" registry value which can be used as a persistence method by malicious actors
windows · registry_set
Startup Item File Created - MacOS
lowDetects the creation of a startup item plist file, that automatically get executed at boot initialization to establish persistence. Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.
macos · file_event