T1037

Boot or Logon Initialization Scripts

ESXi · Linux · macOS · Network Devices · Windowsnothing on this site yetT1037 on attack.mitre.org

Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely. Adversaries may use these scripts to maintain persistence on a single system.
MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

Checklists and playbooks to open while the alert is still live.

Playbook for this stage

Suspicious execution on an endpoint

An EDR alert, an unexplained process, or a user reporting something odd.

Playbook for this stage

Cloud account compromise

Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.

how MITRE says to see it

Boot or Logon Initialization Scripts Detection Strategy

Monitoring modification and execution of user or system logon scripts such as in registry Run keys or startup folders.
Detection of changes or execution of shell initialization scripts like.bashrc,.profile, or /etc/profile for persistence.
Monitoring for modification and execution of login hook scripts or LaunchAgents/LaunchDaemons used for persistence.
Detection of modification to ESXi rc.local.d or rc scripts that are used to execute on boot.

what reduces it

M1022 Restrict File and Directory Permissions. Restrict write access to logon scripts to specific administrators.
M1024 Restrict Registry Permissions. Ensure proper permissions are set for Registry hives to prevent users from modifying keys for logon scripts that may lead to persistence.

sub-techniques

T1037.001 Logon Script (Windows) · not covered yet
T1037.002 Login Hook · not covered yet
T1037.003 Network Logon Script · not covered yet
T1037.004 RC Scripts · not covered yet
T1037.005 Startup Items · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.