T1037.001 Logon Script (Windows)
Subtécnica de T1037 Boot or Logon Initialization Scripts
Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system.(Citation: TechNet Logon Scripts) This is done via adding a path to a script to the HKCU\Environment\UserInitMprLogonScript Registry key.(Citation: Hexacorn Logon Scripts) Adversaries…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- Potential Persistence Via Logon Scripts - CommandLinehightest · windows
- Uncommon Userinit Child Processhightest · windows
- Potential Persistence Via Logon Scripts - Registrymediumtest · windows
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.