kevmap

TechniquesT1037.004 › AN0661

AN0661 Analytic 0661

Network Devices · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Detection of modified boot-time configuration scripts that persist malicious CLI commands across reboots.</p>
Detects
T1037.004 RC Scripts
Part of
DET0237 Detection Strategy for Boot or Logon Initialization Scripts: RC Scripts

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log sourceChannelData component
networkdevice:syslogstartup-configDC0061 File Modification
networkdevice:syslogsystem boot logsDC0064 Command Execution

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

FieldDescription
firmware_familyDevice type or OS determines specific init script location
config_line_patternRegex or pattern matching approach to detect suspicious CLI
reboot_time_windowTime window between config change and first boot post-modification