Cross-source coverage
T1037.001 / ATT&CK
Boot or Logon Initialization Scripts: Logon Script (Windows)
4 rules across 2 sources.
1 deprecated hidden · include
From MITRE ATT&CK 19.2
Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system. This is done via adding a path to a script to the HKCU\Environment\UserInitMprLogonScript Registry key.
Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
- Tactics
- Persistence · Privilege Escalation
- Platforms
- Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:System
How MITRE says to detect it DET0072
Detect Logon Script Modifications and Execution
Windows Analytic 0199
Detects adversary use of logon script configuration via Group Policy or user object attributes, followed by script execution post-authentication. Behavior includes modification of script path or file, then process execution under user logon context.
WinEventLog:SecurityEventCode=4663, 4670, 4656WinEventLog:SystemEventCode=1502, 1503WinEventLog:SecurityEventCode=4624, 4648WinEventLog:SecurityEventCode=4688
SigmaHQ/sigma
3 rules| Detection | Severity | Format |
|---|---|---|
| Potential Persistence Via Logon Scripts - CommandLine | High | Sigma |
| Uncommon Userinit Child Process | High | Sigma |
| Potential Persistence Via Logon Scripts - Registry | Medium | Sigma |
splunk/security_content
1 rule| Detection | Severity | Format |
|---|---|---|
| Logon Script Event Trigger Execution | Undefined | SPL |