Activity timeline
T1037 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-02 with 9 reports, and 29 of the 29 threats were reported in the twelve months to 2026-07.
How adversaries use it
T1037 Boot or Logon Initialization Scripts is catalogued by MITRE ATT&CK under the Persistence and Privilege Escalation tactics in the Enterprise matrix. Threadlinqs maps 29 of 2623 tracked threats (1.1%) to it; by severity that is 17 critical, 12 high.
Threats that use T1037 most often also use T1027 Obfuscated Files or Information (22 threats), T1059 Command and Scripting Interpreter (21 threats), T1005 Data from Local System (20 threats), T1041 Exfiltration Over C2 Channel (19 threats), T1036 Masquerading (17 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
31 tracked threat actors appear in the threats that use T1037; the most frequent are Handala Hack (3), Void Manticore (3), APT28 (2), APT38 (2), APT43 (2).
Mitigations
MITRE ATT&CK lists 2 mitigations for T1037.
Data sources
Telemetry that can reveal T1037, per MITRE ATT&CK.
- Active Directory — Active Directory Object Modification
- Command — Command Execution
- File — File Creation, File Modification
- Process — Process Creation
- Windows Registry — Windows Registry Key Creation
Threat actors using it
Tracked threats
29 tracked threats use T1037.
- Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Processhigh
- BlueNoroff "ClickFake Interview" Zoom/Teams Phishing Kit: AI Deepfake Video Lures, ClickFix PowerShell…high
- SonicWall SMA1000 Zero-Days (CVE-2026-15409, CVE-2026-15410) Chained in Active Attacks, Assessed Ransomware…critical
- SonicWall SMA1000 Zero-Days CVE-2026-15409 (Unauthenticated SSRF, CVSS 10.0) and CVE-2026-15410 (Post-Auth…critical
- TuxBot v3 Evolution: LLM-Assisted IoT Botnet Framework With a Broken Multi-CVE Exploit Chainhigh
- Krybit Ransomware — Babuk-Derived RaaS Operation Emerges with Double Extortionhigh
- AsyncRAT Campaign Abuses TryCloudflare Tunnels and Python Scripts for Malware Delivery…high
- macOS.Gaslight - Rust Backdoor with AI-Analysis Evasion & Prompt Injectioncritical
- DPRK (Kimsuky) Multi-Stage LNK Phishing Campaign Delivering XenoRAT via GitHub-based C2 Targeting South Koreahigh
- Shai-Hulud "Hades" Miasma Worm — New PyPI Wave: 37 Malicious Wheels Across 19 Packages Abuse *-setup.pth…critical
- JDownloader Website Supply Chain Compromise — Trojanized Windows/Linux Installers Deploy Pyarmor-Obfuscated…high
- Lazarus Group (DPRK) Hides BeaverTail / InvisibleFerret Loader in Git Hooks via precommit.vercel.app…high
- Iranian IRGC CyberAv3ngers APT Campaign Targeting Rockwell/Allen-Bradley PLCs (CISA AA26-097A)critical
- BRICKSTORM Backdoor: UNC5221 PRC-Nexus APT Targeting VMware vSphere Infrastructurecritical
- Handala (Void Manticore/MOIS) Abuses Microsoft Entra ID and Intune for Mass Device Wiping at Stryker…critical
- Iranian APT Identity Weaponization: Void Manticore/Handala Abuses Microsoft Intune MDM for Mass Device…critical
- UNC3886 Zero-Day Rootkit Campaign Targeting Singaporean Telecommunications — ORB Network C2, Fortinet/VMware…critical
- Handala Hack (Void Manticore) Wiper Campaign via Microsoft Intune Abuse — Stryker Attackcritical
- Dell RecoverPoint Hardcoded Credentials RCE + UNC6201 GRIMBOLT Backdoor (CVE-2026-22769)critical
- Coruna iOS Exploit Kit — Government-Grade 23-Exploit Arsenal Proliferates from Surveillance Vendor to…critical
- Predator Spyware iOS SpringBoard Hook — Intellexa Recording Indicator Bypass via Kernel-Level Sensor…high
- GitHub Codespaces RCE via VS Code Configuration Fileshigh
- Apple Zero-Day CVE-2026-20700: Memory Corruption Enabling Arbitrary Code Execution — Google TAG-Discovered…critical
- Ghost Tapped: Chinese Tap-to-Pay Android Malware — NFC Relay Fraud at Scalehigh
- Self-Propagating SSH Worm with Cryptographically Signed C2high
- DockerDash: Critical Ask Gordon AI Vulnerability - Code Execution via Image Metadatacritical
- Sangoma FreePBX Authentication Bypass & Command Injection - CISA KEVcritical
- APT28 Operation Neusploit: MS Office CVE-2026-21509 Espionage Campaigncritical
- CVE-2026-21509: Russian Hackers Exploit Microsoft Office Vulnerability Against Ukrainecritical
Detection coverage
Threadlinqs maintains 12 detection rules mapped to T1037 (SPL 4, KQL 4, Sigma 4). Rule content is available to Blue tier accounts and above; this page shows counts only.
Sub-techniques
- T1037.001 Logon Script (Windows) — 7 tracked threats
- T1037.002 Login Hook — 0 tracked threats
- T1037.003 Network Logon Script — 1 tracked threat
- T1037.004 RC Scripts — 18 tracked threats
- T1037.005 Startup Items — 0 tracked threats