BIOC
Medium
✕
Manipulation of Winlogon 'UserInit' autostart Registry key
Winlogon process uses the value specified in the UserInit key to launch login scripts etc. This key is location at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon. Usually, UserInit key points to userinit.exe but if this key can be altered, then that EXE will also launch by Winlogon.
- Module:
- Platform Analytics
- Agent event type:
- Registry
- Category:
- Persistence
- Status:
- Enabled
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001)
Indicator:
Registry action type = all AND registry key name = *\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit Host host os = windows
Preventable: yes