Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. Initialization scripts are part of the underlying operating system and are not accessible to the user unless the device has been rooted or jailbroken.
| ID | Name | Description |
|---|---|---|
| S1095 | AhRat |
AhRat can register with the |
| S1079 | BOULDSPY |
BOULDSPY can exfiltrate data when the user boots the app, or on device boot.[2] |
| S1185 | LightSpy |
LightSpy has established auto-start execution during the system boot process.[3] |
| S0285 | OldBoot |
OldBoot uses escalated privileges to modify the init script on the device's boot partition to maintain persistence.[4] |
| ID | Mitigation | Description |
|---|---|---|
| M1002 | Attestation |
Device attestation could detect devices with unauthorized or unsafe modifications. |
| M1003 | Lock Bootloader |
A locked bootloader could prevent unauthorized modifications to protected operating system files. |
| M1001 | Security Updates |
Security updates frequently contain fixes for vulnerabilities that could be leveraged to modify protected operating system files. |
| M1004 | System Partition Integrity |
Android and iOS include system partition integrity mechanisms that could detect unauthorized modifications. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0654 | Detection of Boot or Logon Initialization Scripts | AN1739 |
Correlates anomalous modifications to boot-time or logon-time initialization artifacts (for example, init.rc, vendor init scripts, app_process or shell hijacks, and malicious BOOT_COMPLETED BroadcastReceivers) with subsequent unauthorized script execution after boot. From the defender’s perspective this appears as integrity or attestation failures on the system partition, unexpected writes to protected init paths, new apps registering for boot events, and privileged processes invoking scripts or binaries from non-standard locations shortly after the device boots. |
| AN1740 |
Correlates unauthorized alterations to launchd configuration (LaunchDaemons/LaunchAgents plists), background execution entitlements, or sideloaded app containers with suspicious auto-start behavior during device boot or user unlock. From the defender’s view this shows up as new or modified plist files in launchd directories, launchd starting binaries from non-Apple or non-AppStore locations, and apps with unexpected background modes that remain active immediately after boot/unlock. |