Startup Script Modification

Overview

Startup Script Modification is a technique where adversaries alter scripts that execute automatically during system or user startup. This method is used to maintain persistence, execute malicious code early in the boot or login process, and evade detection by blending with legitimate system operations.

Attack Objective

• Establish persistence and enable early execution of malicious payloads
• Supports multiple stages including Persistence, Execution, Privilege Escalation, and Defense Evasion
• Advances attacker control by ensuring code runs automatically upon system or user initialization, often with elevated privileges

How the Technique Works

Adversaries identify and modify scripts that are configured to run during system startup or user login, such as batch files, shell scripts, or configuration files. By injecting malicious commands or payloads into these scripts, attackers ensure their code executes automatically each time the system boots or a user session begins, enabling ongoing access and control.

Common Methods & Variations

• Modification of system-wide or user-specific startup scripts (e.g., Windows Startup folder scripts, Group Policy scripts, Linux init scripts, shell profiles)
• Variants exist across on-premises endpoints, cloud-hosted virtual machines, and identity environments where login scripts are used
• Use of living-off-the-land binaries and scripts (LOLBins/LOLscripts) to avoid introducing new files and reduce detection risk versus deploying custom malicious scripts

Indicators of Compromise (IOCs)

• Unexpected changes or additions to startup script files or directories
• Unusual script execution events or command-line activity during system startup or user login
• File system timestamps inconsistent with legitimate administrative changes
• Alerts from endpoint detection tools monitoring script integrity or execution

Detection Strategies

• Monitoring file system changes to known startup script locations and files
• Behavioral detection of anomalous script execution patterns during startup or login
• Correlation of script modifications with other suspicious activities such as privilege escalation or lateral movement

Mitigation & Prevention

• Implement strict access controls and permissions on startup script files and directories
• Use application whitelisting to restrict unauthorized script execution
• Employ integrity monitoring and alerting on critical startup scripts
• Enforce least privilege principles to limit user and process rights to modify startup configurations

Response Considerations

• Immediately isolate affected systems to prevent further execution of malicious startup scripts
• Conduct forensic analysis of modified scripts and related logs to determine scope and timeline
• Remove unauthorized modifications and restore scripts from known good backups
• Harden startup script management processes and review permissions to prevent recurrence

Related Techniques

• Registry Run Keys / Startup Folder (Persistence)
• Scheduled Task/Job (Persistence)
• Service Execution (Execution, Persistence)
• Boot or Logon Autostart Execution

Mapping & References

• MITRE ATT&CK T1543 – Create or Modify System Process
• MITRE ATT&CK T1547 – Boot or Logon Autostart Execution
• Public research on script-based persistence methods and detection best practices