BIOC Medium

Modification of logon scripts via Registry

Windows logon scripts are stored in ``HKCU\Environment\UserInitMprLogonScript`` and trigger when a user logs in. Attackers may abuse them for persistence.

Module:
Platform Analytics
Agent event type:
Registry
Category:
Persistence
Status:
Enabled
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Boot or Logon Initialization Scripts: Logon Script (Windows) (T1037.001)
Indicator:

Registry registry key name = *\Environment AND registry value name = UserInitMprLogonScript AND action type = set_registry_value Host host os = windows

Preventable: yes