BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

1 BIOC match the current filters. tactic: TA0003 ✕ technique: T1037 ✕

Download CSV Show ATT&CK heatmap
  • Modification of logon scripts via Registry Medium Persistence

    Windows logon scripts are stored in ``HKCU\Environment\UserInitMprLogonScript`` and trigger when a user logs in. Attackers may abuse them for persistence.

    Indicator:

    Registry registry key name = *\Environment AND registry value name = UserInitMprLogonScript AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Initialization Scripts: Logon Script (Windows) (T1037.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23