T1037 — Boot or Logon Initialization Scripts

# T1037 - Boot or Logon Initialization Scripts

## SOC Recommendation
Investigate Boot or Logon Initialization Scripts activity in the context of Persistence/Privilege Escalation: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| File Analysis | Detect | Monitor for File Analysis indicators relevant to this technique. |
| File Encryption | Harden | Apply File Encryption to reduce this technique's viability before an incident occurs. |
| File Eviction | Evict | Use File Eviction to remove the adversary's foothold once this technique is confirmed. |
| Content Filtering | Isolate | Apply Content Filtering to contain the blast radius once this technique is observed. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Contain the affected host or account | Medium | No | Yes |
| Collect and preserve evidence | Low | Yes | No |

## KQL
```kql
DeviceEvents
| where TimeGenerated > ago(24h)
| where ActionType has "<tune to T1037>"
```

## Escalation Criteria
- Boot or Logon Initialization Scripts activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1037.json
• /api/recommendations/T1037.json
• /api/d3fend/T1037.json
• /api/mappings/T1037.json
• /api/confluence/T1037.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1037.json

Response:

{
  "technique_id": "T1037",
  "name": "Boot or Logon Initialization Scripts",
  "priority": "high",
  "status": "draft",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Persistence",
    "Privilege Escalation"
  ],
  "platforms": [
    "ESXi",
    "Linux",
    "macOS",
    "Network Devices",
    "Windows"
  ],
  "summary": "Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely. Adversaries may use these scripts to maintain persistence on a single system...",
  "soc_recommendation": "Investigate Boot or Logon Initialization Scripts activity in the context of Persistence/Privilege Escalation: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-FA",
      "name": "File Analysis",
      "relationship": "detect",
      "practical_action": "Monitor for File Analysis indicators relevant to this technique.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FE",
      "name": "File Encryption",
      "relationship": "harden",
      "practical_action": "Apply File Encryption to reduce this technique's viability before an incident occurs.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FEV",
      "name": "File Eviction",
      "relationship": "evict",
      "practical_action": "Use File Eviction to remove the adversary's foothold once this technique is confirmed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-CF",
      "name": "Content Filtering",
      "relationship": "isolate",
      "practical_action": "Apply Content Filtering to contain the blast radius once this technique is observed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed boot or logon initialization scripts activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"Unusual Azure VM Extension Detected\" -- Identifies the first time a given VM extension name is created or updated on an Azure virtual machine or VM scale set within the rule's lookback window. VM extensions run with high privilege on the guest (SYSTEM on Windows, root on Linux) and are a common code-execution and persistence primitive..."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Contain the affected host or account",
      "category": "Containment",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "Defender for Endpoint / Entra ID",
      "notes": "Requires approval -- confirm malicious intent before isolating a host or disabling an account."
    },
    {
      "name": "Collect and preserve evidence",
      "category": "Investigation",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "Defender for Endpoint",
      "notes": "Safe -- read-only evidence collection."
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "Starting point for T1037",
        "description": "Generic starting query -- tune to the specific data source relevant to this technique.",
        "query": "DeviceEvents\n| where TimeGenerated > ago(24h)\n| where ActionType has \"<tune to T1037>\""
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "d29b0a67-178d-4381-92c5-02e9fd9a6ef6 — Unusual Azure VM Extension Detected",
        "description": "(ESQL) Identifies the first time a given VM extension name is created or updated on an Azure virtual machine or VM scale set within the rule's lookback window. VM extensions run with high privilege on the guest (SYSTEM on Windows, root on Linux) and are a common code-execution and persistence primitive... (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "FROM logs-azure.activitylogs-*\n| WHERE event.dataset == \"azure.activitylogs\"\n    AND event.action IN (\n        \"MICROSOFT.COMPUTE/VIRTUALMACHINES/EXTENSIONS/WRITE\",\n        \"MICROSOFT.COMPUTE/VIRTUALMACHINESCALESETS/EXTENSIONS/WRITE\"\n    )\n    AND event.outcome IN (\"success\", \"Success\")\n// azure.resource.name is \"<host>/EXTENSIONS/<instance-name>\"; the instance name is attacker-controlled,\n// so key on the host (first path element) rather than the spoofable extension name\n| EVAL Esql.vm_name = MV_FIRST(SPLIT(azure.resource.name, \"/\"))\n| EVAL Esql.extension_name = MV_LAST(SPLIT(azure.resource.name, \"/\"))\n| STATS Esql.first_time_seen = MIN(@timestamp),\n        Esql.last_time_seen = MAX(@timestamp),\n        Esql.event_count = COUNT(*),\n        Esql.resource_name_values = VALUES(azure.resource.name),\n        Esql.resource_id_values = VALUES(azure.resource.id),\n        Esql.principal_id_values = VALUES(azure.activitylogs.identity.authorization.evidence.principal_id),\n        Esql.principal_type_values = VALUES(azure.activitylogs.identity.authorization.evidence.principal_type),\n        Esql.appid_values = VALUES(azure.activitylogs.identity.claims.appid),\n        Esql.source_ip_values = VALUES(source.ip),\n        Esql.source_as_number_values = VALUES(source.`as`.number),\n        Esql.source_country_values = VALUES(source.geo.country_name),\n        Esql.subscription_id_values = VALUES(azure.subscription_id)\n        BY Esql.vm_name, Esql.extension_name\n// new terms emulation: fire only when the (host, extension name) pair is the single occurrence in the\n// 7-day window (event_count == 1) and it is recent (within the schedule interval + ingest-lag buffer)\n| EVAL Esql.recent_minutes = DATE_DIFF(\"minute\", Esql.first_time_seen, NOW())\n| WHERE Esql.recent_minutes <= 10 AND Esql.event_count == 1\n// surface real fields for the analyst and rule exceptions\n| EVAL azure.resource.name = MV_FIRST(Esql.resource_name_values),\n       azure.resource.id = MV_FIRST(Esql.resource_id_values),\n       source.ip = MV_FIRST(Esql.source_ip_values)\n| KEEP azure.resource.name, azure.resource.id, source.ip, Esql.*"
      },
      {
        "name": "c0136397-f82a-45e5-9b9f-a3651d77e21a — GenAI Process Accessing Sensitive Files",
        "description": "(EQL) Detects when GenAI tools access sensitive files such as cloud credentials, SSH keys, browser password databases, or shell configurations. Attackers leverage GenAI agents to systematically locate and exfiltrate credentials, API keys, and tokens... (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "file where event.action in (\"open\", \"creation\", \"modification\") and event.outcome == \"success\" and\n\n  // GenAI process \n    (\n      process.name in~ (\n        \"ollama.exe\", \"ollama\",\n        \"textgen.exe\", \"textgen\", \"text-generation-webui.exe\", \"oobabooga.exe\",\n        \"lmstudio.exe\", \"lmstudio\", \"LM Studio\",\n        \"claude.exe\", \"claude\",\n        \"cursor.exe\", \"cursor\",\n        \"copilot.exe\", \"copilot\",\n        \"codex.exe\", \"codex\",\n        \"jan.exe\", \"jan\",\n        \"gpt4all.exe\", \"gpt4all\",\n        \"gemini-cli.exe\", \"gemini-cli\", \"gemini.exe\",\n        \"genaiscript.exe\", \"genaiscript\",\n        \"grok.exe\", \"grok\",\n        \"qwen.exe\", \"qwen\",\n        \"koboldcpp.exe\", \"koboldcpp\",\n        \"llama-server\", \"llama-cli\",\n        \"windsurf.exe\", \"windsurf\",\n        \"zed.exe\", \"zed\",\n        \"opencode.exe\", \"opencode\",\n        \"goose.exe\", \"goose\"\n      )\n    ) and\n\n  // Sensitive file paths\n  (\n    // Persistence via Shell configs\n    file.name in (\".bashrc\", \".bash_profile\", \".zshrc\", \".zshenv\", \".zprofile\", \".profile\", \".bash_logout\") or\n\n    // Credentials In Files \n    file.name like~ \n                 (\"key?.db\", \n                  \"logins.json\", \n                  \"Login Data\", \n                  \"Local State\",\n                  \"signons.sqlite\",\n                  \"Cookies\", \n                  \"cookies.sqlite\",\n                  \"Cookies.binarycookies\", \n                  \"login.keychain-db\", \n                  \"System.keychain\", \n                  \"credentials.db\", \n                  \"credentials\", \n                  \"access_tokens.db\", \n                  \"accessTokens.json\", \n                  \"azureProfile.json\",\n                  \"RDCMan.settings\", \n                  \"known_hosts\", \n                  \"KeePass.config.xml\", \n                  \"Unattended.xml\")\n  ) and not (\n    host.os.type == \"windows\" and\n    file.name like~ \"Local State\" and\n    file.path : (\n      \"?:\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\*\\\\Local State\",\n      \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Packages\\\\*\\\\LocalCache\\\\Roaming\\\\*\\\\Local State\"\n    )\n  )"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Boot or Logon Initialization Scripts activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1037 - Boot or Logon Initialization Scripts Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}