Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. Initialization scripts are part of the underlying operating system and are not accessible to the user unless the device has been rooted or jailbroken.
| ID | Name | Description |
|---|---|---|
| S1095 | AhRat |
AhRat can register with the |
| S1079 | BOULDSPY |
BOULDSPY can exfiltrate data when the user boots the app, or on device boot.[2] |
| S1185 | LightSpy |
LightSpy has established auto-start execution during the system boot process.[3] |
| S0285 | OldBoot |
OldBoot uses escalated privileges to modify the init script on the device's boot partition to maintain persistence.[4] |
| ID | Mitigation | Description |
|---|---|---|
| M1002 | Attestation |
Device attestation could detect devices with unauthorized or unsafe modifications. |
| M1003 | Lock Bootloader |
A locked bootloader could prevent unauthorized modifications to protected operating system files. |
| M1001 | Security Updates |
Security updates frequently contain fixes for vulnerabilities that could be leveraged to modify protected operating system files. |
| M1004 | System Partition Integrity |
Android and iOS include system partition integrity mechanisms that could detect unauthorized modifications. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0654 | Detection of Boot or Logon Initialization Scripts | AN1739 |
For Android, detect Boot or Logon Initialization Scripts by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Host Status via Android Enterprise DPC [DevicePolicyManager policy/compliance/security-state queries and SecurityLog events where supported]; Network Traffic Flow via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |
| AN1740 |
For iOS, detect Boot or Logon Initialization Scripts by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Host Status via Apple MDM [DeviceInformation / SecurityInfo / ProfileList / restrictions and compliance queries]; Network Traffic Flow via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |