T1037.001sub-technique of T1037 Boot or Logon Initialization Scripts
Logon Script (Windows)
Windowsnothing on this site yetT1037.001 on attack.mitre.org
Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system. This is done via adding a path to a script to the `HKCU\Environment\UserInitMprLogonScript` Registry key. Adversaries may use these scripts to maintain persistence on a single system.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
Playbook for this stage
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
how MITRE says to see it
Detect Logon Script Modifications and Execution
- Detects adversary use of logon script configuration via Group Policy or user object attributes, followed by script execution post-authentication. Behavior includes modification of script path or file, then process execution under user logon context.
what reduces it
- M1024 Restrict Registry Permissions. Ensure proper permissions are set for Registry hives to prevent users from modifying keys for logon scripts that may lead to persistence.