Automation · API / MCP 中文

Technique note · T1037.001

Logon Script (Windows)

Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system. This is done via adding a path to a script to the <code>HKCU\Environment\UserInitMprLogonScript</code> Registry key. Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.

ATT&CK T1037.001 platforms — Status Active Version 20.1

Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system.1 This is done via adding a path to a script to the <code>HKCU\Environment\UserInitMprLogonScript</code> Registry key.2 Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.

  1. TechNet Logon Scripts
  2. Hexacorn Logon Scripts

Groups using this technique

GroupNameCountry
grp_g0080Cobalt Group—
grp_g0007APT28Russia

Claims

No public claim points at this technique yet.

Auto-ingested and not human-reviewed; confidence and validity read by citation.