T1398: Boot or Logon Initialization Scripts
Essential information
- MITRE technique ID
T1398- Confidence
- 100/100
- Revoked
- No
- Published
- 17/12/2025 22:47
- Modified
- 27/03/2026 01:41
- Author / Source
- The MITRE Corporation
Aliases
T1398
Platforms
android iOS
Description
Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. Initialization scripts are part of the underlying operating system and are not accessible to the user unless the device has been rooted or jailbroken.
Kill chain phases
| Kill chain | Phase |
|---|---|
| mitre-mobile-attack | persistence |
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.