T1037.004sub-technique of T1037 Boot or Logon Initialization Scripts
RC Scripts
macOS · Linux · Network Devices · ESXinothing on this site yetT1037.004 on attack.mitre.org
Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify. Adversaries may establish persistence by adding a malicious binary path or shell commands to `rc.local`, `rc.common`, and other RC scripts specific to the Unix-like distribution.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
how MITRE says to see it
Detection Strategy for Boot or Logon Initialization Scripts: RC Scripts
- Detection of modified or newly created /etc/rc.local or /etc/init.d scripts followed by suspicious execution during system startup.
- Detection of edits or additions to /etc/rc.common, /Library/StartupItems, or /System/Library/StartupItems and associated script execution during login or reboot.
- Detection of changes to /etc/rc.local.d/local.sh or rc.local during post-boot script execution with abnormal commands or additions.
- Detection of modified boot-time configuration scripts that persist malicious CLI commands across reboots.
what reduces it
- M1022 Restrict File and Directory Permissions. Limit privileges of user accounts so only authorized users can edit the `rc.common` file.