# T1037 Boot or Logon Initialization Scripts

> As of 2026-10-05, T1037 (Boot or Logon Initialization Scripts) appears in 29 tracked threats, first reported 2026-02-03 and most recently 2026-07-28, with linked actors including Handala Hack, Void Manticore, APT28; it most often appears alongside T1027 (Obfuscated Files or Information).

- **Tracked threats:** 29 (17 critical, 12 high)
- **First seen:** 2026-02-03
- **Last seen:** 2026-07-28
- **Threat actors:** 31
- **Detection rules:** 12 (counts only; Blue tier and above)

## Key facts

- **ID:** T1037
- **Framework:** MITRE ATT&CK
- **Tactics:** Persistence, Privilege Escalation
- **Matrix:** Enterprise
- **Data as of:** 2026-10-05
- **MITRE:** https://attack.mitre.org/techniques/T1037/

## Activity timeline

T1037 first appeared in tracked threats on 2026-02-03 and was most recently reported on 2026-07-28. The busiest month was 2026-02 with 9 reports, and 29 of the 29 threats were reported in the twelve months to 2026-07.

## How adversaries use it

T1037 Boot or Logon Initialization Scripts is catalogued by MITRE ATT&CK under the Persistence and Privilege Escalation tactics in the Enterprise matrix. Threadlinqs maps 29 of 2623 tracked threats (1.1%) to it; by severity that is 17 critical, 12 high.

Threats that use T1037 most often also use [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (22 threats), [T1059 Command and Scripting Interpreter](https://intel.threadlinqs.com/technique/T1059) (21 threats), [T1005 Data from Local System](https://intel.threadlinqs.com/technique/T1005) (20 threats), [T1041 Exfiltration Over C2 Channel](https://intel.threadlinqs.com/technique/T1041) (19 threats), [T1036 Masquerading](https://intel.threadlinqs.com/technique/T1036) (17 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

31 tracked threat actors appear in the threats that use T1037; the most frequent are [Handala Hack](https://intel.threadlinqs.com/actor/Handala%20Hack) (3), [Void Manticore](https://intel.threadlinqs.com/actor/Void%20Manticore) (3), [APT28](https://intel.threadlinqs.com/actor/APT28) (2), [APT38](https://intel.threadlinqs.com/actor/APT38) (2), [APT43](https://intel.threadlinqs.com/actor/APT43) (2).

## Mitigations

MITRE ATT&CK lists 2 mitigations for T1037.

- [M1022 Restrict File and Directory Permissions](https://attack.mitre.org/mitigations/M1022/)
- [M1024 Restrict Registry Permissions](https://attack.mitre.org/mitigations/M1024/)

## Data sources

Telemetry that can reveal T1037, per MITRE ATT&CK.

- Active Directory — Active Directory Object Modification
- Command — Command Execution
- File — File Creation, File Modification
- Process — Process Creation
- Windows Registry — Windows Registry Key Creation

## Threat actors using it

- [Handala Hack](https://intel.threadlinqs.com/actor/Handala%20Hack) — 3
- [Void Manticore](https://intel.threadlinqs.com/actor/Void%20Manticore) — 3
- [APT28](https://intel.threadlinqs.com/actor/APT28) — 2
- [APT38](https://intel.threadlinqs.com/actor/APT38) — 2
- [APT43](https://intel.threadlinqs.com/actor/APT43) — 2
- [Forest Blizzard](https://intel.threadlinqs.com/actor/Forest%20Blizzard) — 2
- [Handala](https://intel.threadlinqs.com/actor/Handala) — 2
- [Handala Hack Team](https://intel.threadlinqs.com/actor/Handala%20Hack%20Team) — 2
- [Kimsuky](https://intel.threadlinqs.com/actor/Kimsuky) — 2
- [APT29](https://intel.threadlinqs.com/actor/APT29) — 1
- [Andariel](https://intel.threadlinqs.com/actor/Andariel) — 1
- [BlueDelta](https://intel.threadlinqs.com/actor/BlueDelta) — 1

## Tracked threats

29 tracked threats use T1037.

- [Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process](https://intel.threadlinqs.com/threat/TL-2026-1745) — high — 2026-07-28
- [BlueNoroff "ClickFake Interview" Zoom/Teams Phishing Kit: AI Deepfake Video Lures, ClickFix PowerShell…](https://intel.threadlinqs.com/threat/TL-2026-1678) — high — 2026-07-24
- [SonicWall SMA1000 Zero-Days (CVE-2026-15409, CVE-2026-15410) Chained in Active Attacks, Assessed Ransomware…](https://intel.threadlinqs.com/threat/TL-2026-1462) — critical — 2026-07-17
- [SonicWall SMA1000 Zero-Days CVE-2026-15409 (Unauthenticated SSRF, CVSS 10.0) and CVE-2026-15410 (Post-Auth…](https://intel.threadlinqs.com/threat/TL-2026-1382) — critical — 2026-07-15
- [TuxBot v3 Evolution: LLM-Assisted IoT Botnet Framework With a Broken Multi-CVE Exploit Chain](https://intel.threadlinqs.com/threat/TL-2026-1366) — high — 2026-07-15
- [Krybit Ransomware — Babuk-Derived RaaS Operation Emerges with Double Extortion](https://intel.threadlinqs.com/threat/TL-2026-1263) — high — 2026-07-13
- [AsyncRAT Campaign Abuses TryCloudflare Tunnels and Python Scripts for Malware Delivery…](https://intel.threadlinqs.com/threat/TL-2026-1114) — high — 2026-07-02
- [macOS.Gaslight - Rust Backdoor with AI-Analysis Evasion & Prompt Injection](https://intel.threadlinqs.com/threat/TL-2026-0994) — critical — 2026-06-28
- [DPRK (Kimsuky) Multi-Stage LNK Phishing Campaign Delivering XenoRAT via GitHub-based C2 Targeting South Korea](https://intel.threadlinqs.com/threat/TL-2026-0771) — high — 2026-06-10
- [Shai-Hulud "Hades" Miasma Worm — New PyPI Wave: 37 Malicious Wheels Across 19 Packages Abuse *-setup.pth…](https://intel.threadlinqs.com/threat/TL-2026-0709) — critical — 2026-06-07
- [JDownloader Website Supply Chain Compromise — Trojanized Windows/Linux Installers Deploy Pyarmor-Obfuscated…](https://intel.threadlinqs.com/threat/TL-2026-0490) — high — 2026-05-09
- [Lazarus Group (DPRK) Hides BeaverTail / InvisibleFerret Loader in Git Hooks via precommit.vercel.app…](https://intel.threadlinqs.com/threat/TL-2026-0464) — high — 2026-05-06
- [Iranian IRGC CyberAv3ngers APT Campaign Targeting Rockwell/Allen-Bradley PLCs (CISA AA26-097A)](https://intel.threadlinqs.com/threat/TL-2026-0335) — critical — 2026-04-08
- [BRICKSTORM Backdoor: UNC5221 PRC-Nexus APT Targeting VMware vSphere Infrastructure](https://intel.threadlinqs.com/threat/TL-2026-0313) — critical — 2026-04-02
- [Handala (Void Manticore/MOIS) Abuses Microsoft Entra ID and Intune for Mass Device Wiping at Stryker…](https://intel.threadlinqs.com/threat/TL-2026-0268) — critical — 2026-03-22
- [Iranian APT Identity Weaponization: Void Manticore/Handala Abuses Microsoft Intune MDM for Mass Device…](https://intel.threadlinqs.com/threat/TL-2026-0237) — critical — 2026-03-16
- [UNC3886 Zero-Day Rootkit Campaign Targeting Singaporean Telecommunications — ORB Network C2, Fortinet/VMware…](https://intel.threadlinqs.com/threat/TL-2026-0221) — critical — 2026-03-13
- [Handala Hack (Void Manticore) Wiper Campaign via Microsoft Intune Abuse — Stryker Attack](https://intel.threadlinqs.com/threat/TL-2026-0220) — critical — 2026-03-12
- [Dell RecoverPoint Hardcoded Credentials RCE + UNC6201 GRIMBOLT Backdoor (CVE-2026-22769)](https://intel.threadlinqs.com/threat/TL-2026-0194) — critical — 2026-03-07
- [Coruna iOS Exploit Kit — Government-Grade 23-Exploit Arsenal Proliferates from Surveillance Vendor to…](https://intel.threadlinqs.com/threat/TL-2026-0174) — critical — 2026-03-04
- [Predator Spyware iOS SpringBoard Hook — Intellexa Recording Indicator Bypass via Kernel-Level Sensor…](https://intel.threadlinqs.com/threat/TL-2026-0132) — high — 2026-02-22
- [GitHub Codespaces RCE via VS Code Configuration Files](https://intel.threadlinqs.com/threat/TL-2026-0100) — high — 2026-02-16
- [Apple Zero-Day CVE-2026-20700: Memory Corruption Enabling Arbitrary Code Execution — Google TAG-Discovered…](https://intel.threadlinqs.com/threat/TL-2026-0075) — critical — 2026-02-12
- [Ghost Tapped: Chinese Tap-to-Pay Android Malware — NFC Relay Fraud at Scale](https://intel.threadlinqs.com/threat/TL-2026-0067) — high — 2026-02-12
- [Self-Propagating SSH Worm with Cryptographically Signed C2](https://intel.threadlinqs.com/threat/TL-2026-0065) — high — 2026-02-12
- [DockerDash: Critical Ask Gordon AI Vulnerability - Code Execution via Image Metadata](https://intel.threadlinqs.com/threat/TL-2026-0059) — critical — 2026-02-03
- [Sangoma FreePBX Authentication Bypass & Command Injection - CISA KEV](https://intel.threadlinqs.com/threat/TL-2026-0058) — critical — 2026-02-03
- [APT28 Operation Neusploit: MS Office CVE-2026-21509 Espionage Campaign](https://intel.threadlinqs.com/threat/TL-2026-0052) — critical — 2026-02-03
- [CVE-2026-21509: Russian Hackers Exploit Microsoft Office Vulnerability Against Ukraine](https://intel.threadlinqs.com/threat/TL-2026-0041) — critical — 2026-02-03

## Related CVEs

CVEs referenced by the tracked threats that use T1037, most frequent first.

- [CVE-2026-15409](https://intel.threadlinqs.com/cve/CVE-2026-15409)
- [CVE-2026-15410](https://intel.threadlinqs.com/cve/CVE-2026-15410)
- [CVE-2026-21509](https://intel.threadlinqs.com/cve/CVE-2026-21509)
- [CVE-2014-8361](https://intel.threadlinqs.com/cve/CVE-2014-8361)
- [CVE-2017-17215](https://intel.threadlinqs.com/cve/CVE-2017-17215)
- [CVE-2018-10561](https://intel.threadlinqs.com/cve/CVE-2018-10561)
- [CVE-2018-10562](https://intel.threadlinqs.com/cve/CVE-2018-10562)
- [CVE-2019-19006](https://intel.threadlinqs.com/cve/CVE-2019-19006)
- [CVE-2021-22681](https://intel.threadlinqs.com/cve/CVE-2021-22681)
- [CVE-2022-22948](https://intel.threadlinqs.com/cve/CVE-2022-22948)
- [CVE-2022-41328](https://intel.threadlinqs.com/cve/CVE-2022-41328)
- [CVE-2022-42475](https://intel.threadlinqs.com/cve/CVE-2022-42475)
- [CVE-2022-48503](https://intel.threadlinqs.com/cve/CVE-2022-48503)
- [CVE-2023-20867](https://intel.threadlinqs.com/cve/CVE-2023-20867)
- [CVE-2023-32409](https://intel.threadlinqs.com/cve/CVE-2023-32409)
- [CVE-2023-32434](https://intel.threadlinqs.com/cve/CVE-2023-32434)
- [CVE-2023-34048](https://intel.threadlinqs.com/cve/CVE-2023-34048)
- [CVE-2023-38606](https://intel.threadlinqs.com/cve/CVE-2023-38606)
- [CVE-2023-43000](https://intel.threadlinqs.com/cve/CVE-2023-43000)
- [CVE-2023-46805](https://intel.threadlinqs.com/cve/CVE-2023-46805)
- [CVE-2024-21887](https://intel.threadlinqs.com/cve/CVE-2024-21887)
- [CVE-2024-23222](https://intel.threadlinqs.com/cve/CVE-2024-23222)
- [CVE-2025-14174](https://intel.threadlinqs.com/cve/CVE-2025-14174)
- [CVE-2025-21590](https://intel.threadlinqs.com/cve/CVE-2025-21590)
- [CVE-2025-43529](https://intel.threadlinqs.com/cve/CVE-2025-43529)
- [CVE-2025-64328](https://intel.threadlinqs.com/cve/CVE-2025-64328)
- [CVE-2026-20700](https://intel.threadlinqs.com/cve/CVE-2026-20700)
- [CVE-2026-22769](https://intel.threadlinqs.com/cve/CVE-2026-22769)

## Detection coverage

Threadlinqs maintains 12 detection rules mapped to T1037 (SPL 4, KQL 4, Sigma 4). Rule content is available to Blue tier accounts and above; this page shows counts only.

12 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing

## Sub-techniques

- T1037.001 Logon Script (Windows) — 7 tracked threats
- T1037.002 Login Hook — 0 tracked threats
- T1037.003 Network Logon Script — 1 tracked threat
- [T1037.004 RC Scripts](https://intel.threadlinqs.com/technique/T1037.004) — 18 tracked threats
- T1037.005 Startup Items — 0 tracked threats

## Links

- Canonical page: https://intel.threadlinqs.com/technique/T1037
- All techniques: https://intel.threadlinqs.com/techniques
- Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)