Sub-technique of T1037 Boot or Logon Initialization Scripts.View on attack.mitre.org
Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify.
Adversaries may establish persistence by adding a malicious binary path or shell commands to rc.local, rc.common, and other RC scripts specific to the Unix-like distribution. Upon reboot, the system executes the script's contents as root, resulting in persistence.
Adversary abuse of RC scripts is especially effective for lightweight Unix-like distributions using the root user as default, such as ESXi hypervisors, IoT, or embedded systems. As ESXi servers store most system files in memory and therefore discard changes on shutdown, leveraging `/etc/rc.local.d/local.sh` is one of the few mechanisms for enabling persistence across reboots.
Several Unix-like systems have moved to Systemd and deprecated the use of RC scripts. This is now a deprecated mechanism in macOS in favor of Launchd. This technique can be used on Mac OS X Panther v10.3 and earlier versions which still execute the RC scripts. To maintain backwards compatibility some systems, such as Ubuntu, will execute the RC scripts if they exist with the correct file permissions.
Rules on DetectionCode tagged with T1037.004.
| Rule | Type | Risk | Data source |
|---|---|---|---|
| Linux File Creation In Init Boot Directory | Anomaly | NULL | Sysmon for Linux EventID 11 |
None recorded.
| Used by | Procedure example |
|---|---|
| GroupAPT29 | APT29 has installed a run command on a compromised system to enable malware execution on system startup. |
| GroupUNC3886 | UNC3886 has placed a bash installation script into `/etc/rc.local.d/` to establish persistence. |
| GroupVelvet Ant | Velvet Ant used a modified `/etc/rc.local` file on compromised F5 BIG-IP devices to maintain persistence. |
| Used by | Procedure example |
|---|---|
| MalwareCyclops Blink | Cyclops Blink has the ability to execute on device startup, using a modified RC script named S51armled. |
| MalwareGreen Lambert | Green Lambert can add |
| MalwareHiddenWasp | HiddenWasp installs reboot persistence by adding itself to |
| MalwareiKitten | iKitten adds an entry to the rc.common file for persistence. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
