Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0112 — Boot or Logon Initialization Scripts Detection Strategy
DET0112

Boot or Logon Initialization Scripts Detection Strategy

5 analytic(s) · 1 technique(s) detected

Analytics

5
AN0311 Analytic 0311
Windows

Monitoring modification and execution of user or system logon scripts such as in registry Run keys or startup folders.

WinEventLog:Security EventCode=4688 WinEventLog:Security EventCode=4657 WinEventLog:TaskScheduler EventCode=106
[TargetObject] Registry path that may vary by user or policy configuration.
[ParentProcessName] Can be tuned to known parent processes to reduce false positives.
[TimeWindow] Logon activity clustered during specific user shifts.
AN0312 Analytic 0312
Linux

Detection of changes or execution of shell initialization scripts like .bashrc, .profile, or /etc/profile for persistence.

auditd:SYSCALL EXECVE auditd:PATH PATH linux:osquery file_events
[FilePath] Initialization script path that can differ across user and system profiles.
[UserContext] User-level vs root-level configuration.
[TimeWindow] Useful to correlate between file change and subsequent execution.
AN0313 Analytic 0313
macOS

Monitoring for modification and execution of login hook scripts or LaunchAgents/LaunchDaemons used for persistence.

macos:unifiedlog log fs:fsusage file macos:osquery launchd
[Label] LaunchAgent or LaunchDaemon label name, often environment-specific.
[ProgramArguments] Arguments passed to scripts, which may need tuning by environment.
[UserContext] Distinguish between user login and system startup agents.
AN0314 Analytic 0314
ESXi

Detection of modification to ESXi rc.local.d or rc scripts that are used to execute on boot.

esxi:vmkernel boot esxi:hostd boot
[ScriptName] Script path or name may vary across hypervisor versions.
[LogSeverity] Log verbosity settings may alter visibility of activity.
AN0315 Analytic 0315
Network Devices

Detection of changes to device startup-config files that include boot scripts or scheduled execution routines.

networkdevice:syslog config
[Interface] Affected interface or subsystem; varies per device.
[CommandPattern] Patterns of authorized config changes differ by vendor or policy.

Detected Techniques

1

Details

MITRE ID
DET0112
STIX ID
x-mitre-detection-strategy--6928b108-f04e-4a9b-bda5-53bb0c64ec9b
Analytics
5
Techniques Detected
1
By Tactic
Persistence
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.