Monitoring modification and execution of user or system logon scripts such as in registry Run keys or startup folders.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Security | EventCode=4688 |
| Windows Registry Key Modification (DC0063) | WinEventLog:Security | EventCode=4657 |
| Scheduled Job Creation (DC0001) | WinEventLog:TaskScheduler | EventCode=106 |
| Field | Description |
|---|---|
| TargetObject | Registry path that may vary by user or policy configuration. |
| ParentProcessName | Can be tuned to known parent processes to reduce false positives. |
| TimeWindow | Logon activity clustered during specific user shifts. |
Detection of changes or execution of shell initialization scripts like .bashrc, .profile, or /etc/profile for persistence.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | EXECVE |
| File Metadata (DC0059) | auditd:PATH | PATH |
| File Modification (DC0061) | linux:osquery | file_events |
| Field | Description |
|---|---|
| FilePath | Initialization script path that can differ across user and system profiles. |
| UserContext | User-level vs root-level configuration. |
| TimeWindow | Useful to correlate between file change and subsequent execution. |
Monitoring for modification and execution of login hook scripts or LaunchAgents/LaunchDaemons used for persistence.
| Data Component | Name | Channel |
|---|---|---|
| Script Execution (DC0029) | macos:unifiedlog | log |
| File Access (DC0055) | fs:fsusage | file |
| Service Metadata (DC0041) | macos:osquery | launchd |
| Field | Description |
|---|---|
| Label | LaunchAgent or LaunchDaemon label name, often environment-specific. |
| ProgramArguments | Arguments passed to scripts, which may need tuning by environment. |
| UserContext | Distinguish between user login and system startup agents. |
Detection of modification to ESXi rc.local.d or rc scripts that are used to execute on boot.
| Data Component | Name | Channel |
|---|---|---|
| Script Execution (DC0029) | esxi:vmkernel | boot |
| File Modification (DC0061) | esxi:hostd | boot |
| Field | Description |
|---|---|
| ScriptName | Script path or name may vary across hypervisor versions. |
| LogSeverity | Log verbosity settings may alter visibility of activity. |
Detection of changes to device startup-config files that include boot scripts or scheduled execution routines.
| Data Component | Name | Channel |
|---|---|---|
| File Modification (DC0061) | networkdevice:syslog | config |
| Field | Description |
|---|---|
| Interface | Affected interface or subsystem; varies per device. |
| CommandPattern | Patterns of authorized config changes differ by vendor or policy. |