ATT&CK technique
View on MITRE ATT&CK →
T1037.004
RC Scripts
PersistencePrivilege Escalation
12 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | GenAI Process Accessing Sensitive Files | production | 2026-09-25 |
| elastic | Potential Persistence via File Modification | production | 2026-09-18 |
| elastic | Suspicious Network Activity to the Internet by Previously Unknown Executable | production | 2026-09-18 |
| elastic | Pod or Container Creation with Suspicious Command-Line | production | 2026-09-18 |
| elastic | System V Init Script Created | production | 2026-09-18 |
| elastic | Executable Bit Set for Potential Persistence Script | production | 2026-09-18 |
| elastic | rc.local/rc.common File Creation | production | 2026-09-18 |
| elastic | Potential Suspicious File Edit | production | 2026-09-18 |
| elastic | Suspicious rc.local Error Message | production | 2026-09-18 |
| elastic | Potential Execution of rc.local Script | production | 2026-09-18 |
| splunk | Linux File Creation In Init Boot Directory | production | 2026-05-13 |
| elastic | Deprecated - Suspicious File Creation in /etc for Persistence | deprecated | 2025-06-26 |