Cross-source coverage

T1037.001 / ATT&CK

Boot or Logon Initialization Scripts: Logon Script (Windows)

5 rules across 3 sources.

Showing deprecated rules · back to the default

From MITRE ATT&CK 19.2

Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system. This is done via adding a path to a script to the HKCU\Environment\UserInitMprLogonScript Registry key.

Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.

Platforms
Windows
Telemetry
WinEventLog:SecurityWinEventLog:System

How MITRE says to detect it DET0072

Detect Logon Script Modifications and Execution

Windows Analytic 0199

Detects adversary use of logon script configuration via Group Policy or user object attributes, followed by script execution post-authentication. Behavior includes modification of script path or file, then process execution under user logon context.

  • WinEventLog:Security EventCode=4663, 4670, 4656
  • WinEventLog:System EventCode=1502, 1503
  • WinEventLog:Security EventCode=4624, 4648
  • WinEventLog:Security EventCode=4688

View on attack.mitre.org ↗

SigmaHQ/sigma

3 rules
Detection Severity Format
Potential Persistence Via Logon Scripts - CommandLine High Sigma
Uncommon Userinit Child Process High Sigma
Potential Persistence Via Logon Scripts - Registry Medium Sigma

chronicle/detection-rules

1 rule
Detection Severity Format
mitre_attack_T1037_001_windows_logon_script Undefined YARA-L

splunk/security_content

1 rule
Detection Severity Format
Logon Script Event Trigger Execution Undefined SPL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.