RC Scripts
Subtechnique · ATTACK:enterprise:T1037.004
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1037.004",
"title": "RC Scripts",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1037/004",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--dca670cf-eeec-438f-8185-fd959d9ef211",
"external_id": "T1037.004",
"domain": "enterprise",
"created": "2020-01-15T16:25:22.260Z",
"modified": "2025-10-24T17:49:28.955Z",
"version": "2.2",
"aliases": [
],
"tactics": [
"persistence",
"privilege-escalation"
],
"source_references": [
{
"source_name": "Apple Developer Doco Archive Launchd",
"url": "https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html"
},
{
"source_name": "Startup Items",
"url": "https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html"
},
{
"source_name": "Juniper Networks ESXi Backdoor 2022",
"url": "https://blogs.juniper.net/en-us/threat-research/a-custom-python-backdoor-for-vmware-esxi-servers"
},
{
"source_name": "Ubuntu Manpage systemd rc",
"url": "http://manpages.ubuntu.com/manpages/bionic/man8/systemd-rc-local-generator.8.html"
},
{
"source_name": "IranThreats Kittens Dec 2017",
"url": "https://iranthreats.github.io/resources/attribution-flying-rocket-kitten/"
},
{
"source_name": "Methods of Mac Malware Persistence",
"url": "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf"
},
{
"source_name": "intezer-kaiji-malware",
"url": "https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/"
},
{
"source_name": "Intezer HiddenWasp Map 2019",
"url": "https://www.intezer.com/blog-hiddenwasp-malware-targeting-linux-systems/"
}
]
}Explicit source assertions (11)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1037.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--116ba54b-b2b3-4e63-9f5b-c5171dde0863
ATTACK:enterprise:T1037.004 → subtechnique-of → ATTACK:enterprise:T1037
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--14a0804b-1b76-43e1-8fe5-96962b1da942
ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1037.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b636fe8-0ea3-40de-92f9-76ba806352b9
Sygnia VelvetAnt 2024AATTACK:enterprise:S0394 → uses → ATTACK:enterprise:T1037.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7ced0df2-1d05-40ea-986e-28692c028d92
Intezer HiddenWasp Map 2019ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1037.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8859cfd8-dfa2-4e89-9003-e67a60218442
CheckPointResearch_TheGentlemen_April2026ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1037.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8d46d48e-cd93-4e9f-a28c-c09e3a072194
Google Cloud Threat Intelligence ESXi VIBs 2022ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1037.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--91e9d060-8d6f-4d3a-9c69-8935f8e72338
Mandiant APT29 Eye Spy Email Nov 22ATTACK:enterprise:S0690 → uses → ATTACK:enterprise:T1037.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b745cf21-c63a-42f2-bc98-6bd61674917a
Objective See Green Lambert for OSX Oct 2021 · Glitch-Cat Green Lambert ATTCK Oct 2021ATTACK:enterprise:S9046 → uses → ATTACK:enterprise:T1037.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dd394bf9-aecd-45b9-8547-477c7c8a7756
Claroty-IOCONTROL · Armis-IOCONTROLATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1037.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e8a13c1f-d4b9-495d-b039-112c4d60916b
NCSC Cyclops Blink February 2022ATTACK:enterprise:S0278 → uses → ATTACK:enterprise:T1037.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fed9f1de-bd5b-4715-ae70-ad457e89a988
objsee mac malware 2017