{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/init-scripts/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["low"],"_cs_tags":["persistence","linux","init-scripts"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eAdversaries targeting Linux systems frequently leverage legacy initialization directories to establish persistence. By placing malicious scripts or binaries within the /etc/init.d/, /etc/init/, or /etc/inittab directories, attackers ensure their code executes during the system startup process. Although modern Linux distributions have largely transitioned to systemd, the systemd-sysv-generator utility remains active on many systems to maintain backward compatibility, automatically converting these legacy files into functional systemd services.\u003c/p\u003e\n\u003cp\u003eWhen these scripts are processed, they typically execute with root-level privileges, providing the adversary with a highly privileged foothold. This technique is frequently observed in malware such as HiddenWasp, which utilizes these mechanisms to ensure survival across reboots. Detecting this behavior requires visibility into file creation and modification events within sensitive system directories, filtered against legitimate package management activity that may perform similar operations during software updates or system maintenance.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains initial access to a Linux system (e.g., via exploit, credential theft, or web shell).\u003c/li\u003e\n\u003cli\u003eAttacker escalates privileges to root to gain write access to system directories.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious shell script or binary containing the desired payload.\u003c/li\u003e\n\u003cli\u003eAttacker writes the file to /etc/init.d/ or /etc/init/ to register it as a startup service.\u003c/li\u003e\n\u003cli\u003eAttacker marks the file as executable using the chmod utility.\u003c/li\u003e\n\u003cli\u003eThe systemd-sysv-generator utility detects the new file and converts it into a systemd service unit.\u003c/li\u003e\n\u003cli\u003eUpon the next system reboot, the initialization process triggers the script, executing the malicious payload with root privileges.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to maintain long-term persistence on compromised Linux servers, enabling data exfiltration, lateral movement, and command-and-control communication. Because the scripts run as root, this persistence mechanism is exceptionally difficult to remove without full incident response intervention. This technique affects any Linux environment where legacy System V initialization compatibility is maintained, particularly legacy infrastructure or servers configured to support older service management workflows.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eDeploy the Sigma rule provided below to monitor for suspicious file creation in initialization directories.\u003c/li\u003e\n\u003cli\u003eBaseline authorized software installation paths and package manager binaries (e.g., apt, dnf, rpm) to reduce false positives in the detection rule.\u003c/li\u003e\n\u003cli\u003eRegularly audit the /etc/init.d/ and /etc/init/ directories for unauthorized or unrecognized scripts.\u003c/li\u003e\n\u003cli\u003eUtilize the Osquery queries provided in the source metadata to perform routine integrity checks on these directories.\u003c/li\u003e\n\u003cli\u003eIf an unauthorized script is discovered, isolate the host and perform a full forensic analysis to identify the initial compromise vector and hidden backdoors.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-11T12:50:06Z","date_published":"2026-09-11T12:50:06Z","id":"https://feed.craftedsignal.io/briefs/2026-09-linux-init-d-persistence/","summary":"Adversaries gain persistence on Linux systems by creating or modifying initialization scripts in /etc/init.d/ or /etc/init/, allowing for malicious code execution with root privileges during system boot.","title":"Linux Persistence via System V Init Script Manipulation","url":"https://feed.craftedsignal.io/briefs/2026-09-linux-init-d-persistence/"}],"language":"en","title":"CraftedSignal Threat Feed - Init-Scripts","version":"https://jsonfeed.org/version/1.1"}