MITRE ATT&CKtechnique

T1398 Boot or Logon Initialization Scripts

Published 2017-10-25 Modified 2025-10-24 Official page ↗
Domain
mobile
Tactics
Persistence
Platforms
Android, iOS
Version
2.1
Created
2017-10-25

Description

Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. Initialization scripts are part of the underlying operating system and are not accessible to the user unless the device has been rooted or jailbroken.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (4)

  • M1001 Security Updates mitigation
  • M1002 Attestation mitigation
  • M1003 Lock Bootloader mitigation
  • M1004 System Partition Integrity mitigation

Referenced by MITRE ATT&CK · uses (4)

  • S1185 LightSpy software (malware)
  • S1095 AhRat software (malware)
  • S1079 BOULDSPY software (malware)
  • S0285 OldBoot software (malware)

References