T1037.004 — RC Scripts

Tactics: Persistence, Privilege Escalation · Platforms: macOS, Linux, Network Devices, ESXi

Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify. Adversaries may…

Sub-technique of Boot or Logon Initialization Scripts (T1037).

Sigma detection rules (4)

title: "T1037.004 Boot or Logon Initialization Scripts: RC Scripts"
id: cdc1df83-e604-4d54-9621-e2e6fb01f6c4
description: 'Detection Strategy for Boot or Logon Initialization Scripts: RC Scripts. (Retargeted to the file_event auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: script_path, user_context, time_window.'
references:
  - https://attack.mitre.org/techniques/T1037/004
author: Shahrukh Khan
date: 2026-02-12
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1037.004

logsource:
  category: file_event
  product: linux

detection:
  selection:
    type: PATH
    name|startswith:
      - '/etc/init.d/'
      - '/etc/rc.local'
      - '/etc/rc.d/'
    nametype:
      - CREATE
      - NORMAL
  condition: selection

falsepositives:
  - Legitimate package installation or system configuration management writing to init.d/rc.local during normal service setup.

level: high

title: "T1037.004 Boot or Logon Initialization Scripts: RC Scripts"
id: fa0f92fc-ebf4-4dbd-afd2-e7e538f50687
description: 'Detection Strategy for Boot or Logon Initialization Scripts: RC Scripts. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: script_name, event_interval, file_permission.'
references:
  - https://attack.mitre.org/techniques/T1037/004
author: Shahrukh Khan
date: 2026-03-07
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1037.004

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    CommandLine|contains:
      - '/etc/rc.common'
      - '/Library/StartupItems/'
  condition: selection

falsepositives:
  - Legacy third-party software still using deprecated StartupItems on older macOS installations.

level: medium

title: "T1037.004 Boot or Logon Initialization Scripts: RC Scripts"
id: 85e972e1-ef3c-42b2-b20c-8e72cb37d774
description: 'Detection Strategy for Boot or Logon Initialization Scripts: RC Scripts. (Retargeted: the previous rule matched EXECVE of bash/sh invoked WITH an rc script path as an argument, which is how the OS and normal service management execute these scripts at boot/restart, not how an adversary edits them; this version instead watches for actual writes to the RC script paths via PATH records, since RC scripts already exist on disk so a malicious edit typically produces nametype NORMAL rather than CREATE.) Tune using: firmware_family, config_line_pattern, reboot_time_window.'
references:
  - https://attack.mitre.org/techniques/T1037/004
author: Shahrukh Khan
date: 2026-06-12
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1037.004

logsource:
  category: file_event
  product: linux
  service: auditd

detection:
  selection_rc_script_write:
    type: PATH
    nametype:
      - CREATE
      - NORMAL
      - DELETE
    name|contains:
      - '/etc/rc.local'
      - '/etc/rc.d/'
      - '/etc/rc.common'
      - '/etc/init.d/'

  condition: selection_rc_script_write

falsepositives:
  - Legitimate system provisioning and configuration management tools such as Ansible, cloud-init, or package post-install scripts modify the same rc.local and rc.d startup script paths during normal server setup and patching.

level: high

title: "T1037.004 Boot or Logon Initialization Scripts: RC Scripts"
id: e8f3f9d1-5514-48db-8442-1f1521d7ed41
description: 'Detection Strategy for Boot or Logon Initialization Scripts: RC Scripts. (Retargeted to the file_change ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: script_section, command_type, execution_trigger.'
references:
  - https://attack.mitre.org/techniques/T1037/004
author: Shahrukh Khan
date: 2026-05-28
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1037.004

logsource:
  category: file_change
  product: esxi
  service: hostd

detection:
  selection:
    Message|contains: '/etc/rc.local.d/local.sh'
  selection_mod:
    Message|contains:
      - 'modified'
      - 'written'

  condition: selection and selection_mod

falsepositives:
  - Authorized configuration management tools such as Host Profiles or PowerCLI scripts that persist settings via local.sh will also modify this file.

level: high

Related sub-techniques

• T1037.001 Logon Script (Windows)
• T1037.005 Startup Items
• T1037.002 Login Hook
• T1037.003 Network Logon Script

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1037.004 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan