MITRE ATT&CK · Enterprise

T1037.001 — Boot or Logon Initialization Scripts: Logon Script (Windows)

Sub-technique of T1037 Boot or Logon Initialization Scripts

T1037.001

Platforms

Windows

Tactics

Persistence Privilege Escalation

Description

Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system. This is done via adding a path to a script to the HKCU\Environment\UserInitMprLogonScript Registry key.

Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.

Detected by EasySIEM

This project's own SigmaHQ-derived detection pipeline tags every compiled rule with the ATT&CK technique(s) it maps to -- if a rule in your install covers this technique, it shows up automatically on your own Grafana Alerts dashboard's "Top ATT&CK Techniques" panel, no lookup needed. This page exists so a click from there always lands here on easysiem.com, not on attack.mitre.org.

View this technique on the official MITRE ATT&CK site ↗