BIOC
Medium
✕
Modification of logon scripts via Registry
Windows logon scripts are stored in ``HKCU\Environment\UserInitMprLogonScript`` and trigger when a user logs in. Attackers may abuse them for persistence.
- Module:
- Platform Analytics
- Agent event type:
- Registry
- Category:
- Persistence
- Status:
- Enabled
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Boot or Logon Initialization Scripts: Logon Script (Windows) (T1037.001)
Indicator:
Registry registry key name = *\Environment AND registry value name = UserInitMprLogonScript AND action type = set_registry_value Host host os = windows
Preventable: yes