Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Boot or Logon Initialization Scripts

Sub-techniques (5)

ID	Name
.001	Logon Script (Windows)
.002	Login Hook
.003	Network Logon Script
.004	RC Scripts
.005	Startup Items

Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.(Citation: Mandiant APT29 Eye Spy Email Nov 22)(Citation: Anomali Rocke March 2019) Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely. Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.

ID: T1037

Sub-techniques: .001 .002 .003 .004 .005

Tactic(s): Persistence, Privilege Escalation

Platforms: Linux, macOS, Network, Windows

Data Sources: Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Creation, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation

Version: 2.3

Created: 31 May 2017

Last Modified: 16 Apr 2024

Name	Description
Procedure Examples
APT41	APT41 used a hidden shell script in `/etc/rc.d/init.d` to leverage the `ADORE.XSEC`backdoor and `Adore-NG` rootkit.(Citation: apt41_mandiant)
APT29	APT29 has hijacked legitimate application-specific startup scripts to enable malware to execute on system startup.(Citation: Mandiant APT29 Eye Spy Email Nov 22)
RotaJakiro	Depending on the Linux distribution and when executing with root permissions, RotaJakiro may install persistence using a `.conf` file in the `/etc/init/` folder.(Citation: RotaJakiro 2021 netlab360 analysis)
Rocke	Rocke has installed an "init.d" startup script to maintain persistence.(Citation: Anomali Rocke March 2019)

Mitigation	Description
Mitigations
Logon Scripts Mitigation	Restrict write access to logon scripts to specific administrators. Prevent access to administrator accounts by mitigating Credential Access techniques and limiting account access and permissions of Valid Accounts. Identify and block potentially malicious software that may be executed through logon script modification by using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) that are capable of auditing and/or blocking unknown programs.
Restrict Registry Permissions	Restrict the ability to modify certain hives or keys in the Windows Registry.
Restrict File and Directory Permissions	Restrict access by setting directory and file permissions that are not specific to users or privileged accounts.

Detection

Monitor logon scripts for unusual access by abnormal users or at abnormal times. Look for files added or modified by unusual accounts outside of normal administration duties. Monitor running process for actions that could be indicative of abnormal programs or executables running upon logon.

References

Связанные риски

Риск	Связи
Закрепление злоумышленника в ОС из-за возможности помещения скрипта в автозагрузку через Windows logon scripts в ОС Windows Повышение привилегий НСД

Каталоги

Техники ATT&CK:

T1037.001 Boot or Logon Initialization Scripts: Logon Script (Windows)

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.