Techniques › T1037 › T1037.001
T1037.001 Logon Script (Windows)
persistence · privilege escalation — Windows · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
3
Sigma rules tagged attack.t1037.001
0
KEV CVEs mapped here
<p>Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system. This is done via adding a path to a script to the <code>HKCU\Environment\UserInitMprLogonScript</code> Registry key.</p><p>Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0072 Detect Logon Script Modifications and Execution v1.0
AN0199 WindowsDetects adversary use of logon script configuration via Group Policy or user object attributes, followed by script execution post-authentication. Behavior includes modification of script path or file, then process execution under user logon context.Tunable:
script_path_keywordsexecution_time_windowuser_context
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1037.001
Author: Tom Ueltschi (@c_APT_ure), Tim Shelton
· 2019-01-12 (modified 2023-11-14) · logsource: product=windows category=process_creation · 0a98a10c-685d-4ab0-bddc-b6bdd1d48458
Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for persistence.
Author: Tom Ueltschi (@c_APT_ure)
· 2019-01-12 (modified 2023-06-09) · logsource: product=windows category=process_creation · 21d856f9-9281-4ded-9377-51a1a6e2a432
Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence
Author: Tom Ueltschi (@c_APT_ure)
· 2019-01-12 (modified 2025-10-26) · logsource: product=windows category=registry_set · 9ace0707-b560-49b8-b6ca-5148b42f39fb
Detects creation of "UserInitMprLogonScript" registry value which can be used as a persistence method by malicious actors