Boot or Logon Initialization Scripts
- ID
- T1037
- Tactics
- TA0003 Persistence, TA0004 Privilege Escalation
- Platforms
- ESXi, Linux, macOS, Network Devices, Windows
- Data sources
- Process Creation, Windows Registry Key Modification, Scheduled Job Creation, File Metadata, File Modification, Script Execution, File Access, Service Metadata
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.[1][2] Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely.
Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.
Sub-techniques (5)
- T1037.001 Logon Script (Windows)
- T1037.002 Login Hook
- T1037.003 Network Logon Script
- T1037.004 RC Scripts
- T1037.005 Startup Items
Detection
- DET0112 Boot or Logon Initialization Scripts Detection Strategy
Data components: Process Creation, Windows Registry Key Modification, Scheduled Job Creation, File Metadata, File Modification, Script Execution, File Access, Service Metadata
Mitigations (2)
- M1022 Restrict File and Directory Permissions
Restrict write access to logon scripts to specific administrators.
- M1024 Restrict Registry Permissions
Ensure proper permissions are set for Registry hives to prevent users from modifying keys for logon scripts that may lead to persistence.