CAPEC-564: Run Software at Logon
Description
Operating system allows logon scripts to be run whenever a specific user or users logon to a system. If adversaries can access these scripts, they may insert additional code into the logon script. This code can allow them to maintain persistence or move laterally within an enclave because it is executed every time the affected user or users logon to a computer. Modifying logon scripts can effectively bypass workstation and enclave firewalls. Depending on the access configuration of the logon scripts, either local credentials or a remote administrative account may be necessary.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- Not rated by MITRE
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Inject Unexpected Items
Mitigations
- Restrict write access to logon scripts to necessary administrators.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
- T1037Boot or Logon Initialization Scripts
- T1543.001Create or Modify System Process: Launch Agent
- T1543.004Create or Modify System Process: Launch Daemon
- T1547Boot or Logon Autostart Execution
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 3 ATT&CK techniques above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-CFContent Filtering3 shared
- D3-CMContent Modification3 shared
- D3-DFDecoy File3 shared
- D3-FAFile Analysis3 shared
- D3-FEFile Encryption3 shared
- D3-FEVFile Eviction3 shared
- D3-FIMFile Integrity Monitoring3 shared
- D3-LFPLocal File Permissions3 shared
- D3-RFAMRemote File Access Mediation3 shared
- D3-RFRestore File3 shared
- D3-CQContent Quarantine3 shared
- D3-SICASystem Init Config Analysis2 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2013-01-002Autorun Differences3 shared
- CAR-2013-09-005Service Outlier Executables1 shared
- CAR-2014-05-002Services launching Cmd1 shared
- CAR-2020-11-001Boot or Logon Initialization Scripts1 shared
- CAR-2014-03-005Remotely Launched Executables via Services1 shared
- CAR-2021-11-002Registry Edit with Modification of Userinit, Shell or Notify1 shared
- CAR-2021-12-002Modification of Default Startup Folder in the Registry Key 'Common Startup'1 shared
- CAR-2014-02-001Service Binary Modifications1 shared
- CAR-2013-03-001Reg.exe called from Command Shell1 shared
- CAR-2020-05-003Rare LolBAS Command Lines1 shared
- CAR-2013-04-002Quick execution of a series of suspicious commands1 shared