CAPEC-564: Run Software at Logon
Operating system allows logon scripts to be run whenever a specific user or users logon to a system. If adversaries can access these scripts, they may insert additional code into the logon script. This code can allow them to maintain persistence or move laterally within an enclave because it is executed every time the affected user or users logon to a computer. Modifying logon scripts can effectively bypass workstation and enclave firewalls. Depending on the access configuration of the logon scripts, either local credentials or a remote administrative account may be necessary.
Last updated
Overview
CAPEC-564 (Run Software at Logon) is a detailed-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.
How to mitigate it
Defenses that reduce the risk of CAPEC-564.
- Restrict write access to logon scripts to necessary administrators.
Terminology & mappings
Mapped taxonomies
- ATTACK: Boot or Logon Initialization Scripts (1037)
- ATTACK: Create or Modify System Process: Launch Agent (1543.001)
- ATTACK: Create or Modify System Process: Launch Daemon (1543.004)