MITRE ATT&CKsub-technique

T1037.004 RC Scripts

Published 2020-01-15 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Persistence, Privilege Escalation
Platforms
macOS, Linux, Network Devices, ESXi
Version
2.2
Created
2020-01-15

Description

Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify. Adversaries may establish persistence by adding a malicious binary path or shell commands to rc.local, rc.common, and other RC scripts specific to the Unix-like distribution. Upon reboot, the system executes the script's contents as root, resulting in persistence. Adversary abuse of RC scripts is especially effective for lightweight Unix-like distributions using the root user as default, such as ESXi hypervisors, IoT, or embedded systems. As ESXi servers store most system files in memory and therefore discard changes on shutdown, leveraging `/etc/rc.local.d/local.sh` is one of the few mechanisms for enabling persistence across reboots. Several Unix-like systems have moved to Systemd and deprecated the use of RC scripts. This is now a deprecated mechanism in macOS in favor of Launchd. This technique can be used on Mac OS X Panther v10.3 and earlier versions which still execute the RC scripts. To maintain backwards compatibility some systems, such as Ubuntu, will execute the RC scripts if they exist with the correct file permissions.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1037 Boot or Logon Initialization Scripts technique

Tactic · MITRE ATT&CK (2)

  • TA0003 Persistence tactic
  • TA0004 Privilege Escalation tactic

Referenced by MITRE ATT&CK · mitigates (1)

  • M1022 Restrict File and Directory Permissions mitigation

Referenced by MITRE ATT&CK · uses (9)

  • S9051 The Gentlemen Ransomware software (malware)
  • S9046 IOControl software (malware)
  • G1048 UNC3886 group
  • G1047 Velvet Ant group
  • S0690 Green Lambert software (malware)
  • S0687 Cyclops Blink software (malware)
  • S0394 HiddenWasp software (malware)
  • S0278 iKitten software (malware)
  • G0016 APT29 group

Referenced by Compliance · mitigates (7)

  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References