Potential Persistence Via Logon Scripts - Registry

Title: Potential Persistence Via Logon Scripts - Registry
Status: test
Description:Detects creation of "UserInitMprLogonScript" registry value which can be used as a persistence method by malicious actors
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1037.001/T1037.001.md
Author: Tom Ueltschi (@c_APT_ure)
Date: 2019-01-12
modified:2025-10-26
Tags:

• -'attack.privilege-escalation'
• -'attack.t1037.001'
• -'attack.persistence'
• -'attack.lateral-movement'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|contains: 'UserInitMprLogonScript'
  condition:selection
Falsepositives:
  -Investigate the contents of the "UserInitMprLogonScript" value to determine of the added script is legitimate
Level: medium