MITRE ATT&CK technique

T1163

Rc.common

About this technique

During the boot process, macOS executes <code>source /etc/rc.common</code>, which is a shell script containing various utility functions. This file also defines routines for processing command-line arguments and for gathering system settings, and is thus recommended to include in the start of Startup Item Scripts (Citation: Startup Items).

Read the full ATT&CK description

In macOS and OS X, this is now a deprecated technique in favor of launch agents and launch daemons, but is currently still used.

Adversaries can use the rc.common file as a way to hide code for persistence that will execute on each reboot as the root user (Citation: Methods of Mac Malware Persistence).

TA0003
Curated mapping

Curated incident relationships

These associations come from maintained incident records. The recorded confidence is shown when the source record provides it.

0 items
No curated incident mappings yet.
Heuristic association

Daily items linked through predicted CVEs

A Daily item appears here when it mentions a CVE whose triage artifact predicts this technique. This is not a verified ATT&CK mapping.

0 items
No heuristic Daily associations yet.
Heuristic association

Predicted CVE associations

These backfilled or model-produced candidates come from the current triage artifact. They are informational, not official MITRE mappings.

0 items
No predicted associations yet for this technique.
T1163 · Rc.common · Baitaphish