MITRE ATT&CK technique · Persistence, Privilege Escalation

`T1037.001` Logon Script (Windows)

Sub-technique of T1037 Boot or Logon Initialization Scripts

Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system.(Citation: TechNet Logon Scripts) This is done via adding a path to a script to the HKCU\Environment\UserInitMprLogonScript Registry key.(Citation: Hexacorn Logon Scripts) Adversaries…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

APT28

Sigma rules to hunt it

Potential Persistence Via Logon Scripts - CommandLinehightest · windows
Uncommon Userinit Child Processhightest · windows
Potential Persistence Via Logon Scripts - Registrymediumtest · windows

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.