MITRE ATT&CK - Technique Boot or Logon Initialization Scripts

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Boot or Logon Initialization Scripts

Sub-techniques (5)

ID	Name
.001	Logon Script (Windows)
.002	Login Hook
.003	Network Logon Script
.004	RC Scripts
.005	Startup Items

Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely. Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.

ID: T1037

Sub-techniques: .001 .002 .003 .004 .005

Tactic(s): Persistence, Privilege Escalation

Platforms: Linux, macOS, Windows

Data Sources: Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Creation, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation

Version: 2.1

Created: 31 May 2017

Last Modified: 01 Apr 2022

Name	Description
Procedure Examples
Rocke	Rocke has installed an "init.d" startup script to maintain persistence.(Citation: Anomali Rocke March 2019)

Mitigation	Description
Mitigations
Logon Scripts Mitigation	Restrict write access to logon scripts to specific administrators. Prevent access to administrator accounts by mitigating Credential Access techniques and limiting account access and permissions of Valid Accounts. Identify and block potentially malicious software that may be executed through logon script modification by using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) that are capable of auditing and/or blocking unknown programs.
Restrict Registry Permissions	Restrict the ability to modify certain hives or keys in the Windows Registry.
Restrict File and Directory Permissions	Restrict access by setting directory and file permissions that are not specific to users or privileged accounts.

Detection

Monitor logon scripts for unusual access by abnormal users or at abnormal times. Look for files added or modified by unusual accounts outside of normal administration duties. Monitor running process for actions that could be indicative of abnormal programs or executables running upon logon.

References

Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019.

Связанные риски

Риск	Связи
Закрепление злоумышленника в ОС из-за возможности помещения скрипта в автозагрузку через Windows logon scripts в ОС Windows Повышение привилегий НСД

Каталоги

Техники ATT&CK:

T1037.001 Boot or Logon Initialization Scripts: Logon Script (Windows)

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.