T1037PersistencePrivilege Escalation
Boot or Logon Initialization Scripts
Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely. Adversaries may use these scripts to…
CVEs3
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.3
Reports0
CVEs linked to Boot or Logon Initialization Scripts
3 CVEs, by priority. Each link shows its badge.- CVE-2024-20353Cisco ASA and FTD Denial of Service VulnerabilityCisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)KEVPublic exploitHigh · 8.6T1608.001Upload MalwareT1190Exploit Public-Facing Application+2 more · 2 reportsMITRE CTID mapping of the KEV entry · follow-on activity69.8%Top 0.63%85.0priority
- CVE-2024-20359Cisco ASA and FTD Privilege Escalation VulnerabilityCisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)KEVPublic exploitMedium · 6.0T1078Valid AccountsT1059Command and Scripting Interpreter+1 more · 2 reportsMITRE CTID mapping of the KEV entry · follow-on activity18.8%Top 2.7%82.8priority
- CVE-2022-41328Fortinet FortiOS Path Traversal VulnerabilityFortinet · FortiOSKEVHigh · 7.1T1574Hijack Execution FlowT1037Boot or Logon Initialization Scripts+2 more · 1 reportMITRE CTID mapping of the KEV entry · primary impact10.7%Top 4.2%66.0priority