MITRE ATT&CKsub-technique

T1037.001 Logon Script (Windows)

Published 2020-01-10 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Persistence, Privilege Escalation
Platforms
Windows
Version
1.0
Created
2020-01-10

Description

Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system. This is done via adding a path to a script to the HKCU\Environment\UserInitMprLogonScript Registry key. Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1037 Boot or Logon Initialization Scripts technique

Tactic · MITRE ATT&CK (2)

  • TA0003 Persistence tactic
  • TA0004 Privilege Escalation tactic

Referenced by MITRE ATT&CK · mitigates (1)

  • M1024 Restrict Registry Permissions mitigation

Referenced by MITRE ATT&CK · uses (6)

  • S0526 KGH_SPY software (malware)
  • S0438 Attor software (malware)
  • G0080 Cobalt Group group
  • S0251 Zebrocy software (malware)
  • G0007 APT28 group
  • S0044 JHUHUGIT software (malware)

Referenced by Compliance · mitigates (2)

  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control

References