tfMITRE ATT&CK sub-technique

Logon Script (Windows) T1037.001

sub-technique of T1037 Boot or Logon Initialization Scripts

Tactics: Persistence, Privilege Escalation
Platform: Windows
Version: 1.0
Created: 10 January 2020
Last modified: 24 October 2025

Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system.[1] This is done via adding a path to a script to the HKCU\Environment\UserInitMprLogonScript Registry key.[2]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware62nd pct

Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules60th pct

Detection rules60th percentile · 60% of ATT&CK techniques have this many detection rules written or fewer.

Logon Script (Windows) MITRE reference T1037.001

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Cobalt GroupG0080 ↗

Has added persistence by registering the file name for the next stage malware under HKCU\Environment\UserInitMprLogonScript.1

created 2018-10-171 referenceaka GOLD KINGSWOOD

APT28G0007 ↗

An APT28 loader Trojan adds the Registry key HKCU\Environment\UserInitMprLogonScript to establish persistence.1

created 2017-05-311 referenceaka IRON TWILIGHT

All 2 groups for this technique

4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

KGH_SPYS0526 ↗

Has the ability to set the HKCU\Environment\UserInitMprLogonScript Registry key to execute logon scripts.1

created 2020-11-06MALWAREcarried by 1 group

AttorS0438 ↗

Attor's dispatcher can establish persistence via adding a Registry key with a logon script HKEY_CURRENT_USER\Environment "UserInitMprLogonScript" .1

created 2020-05-06MALWARE

ZebrocyS0251 ↗

Performs persistence with a logon script via adding to the Registry key HKCU\Environment\UserInitMprLogonScript.1

created 2018-10-17MALWAREcarried by 1 group

JHUHUGITS0044 ↗

Has registered a Windows shell script under the Registry key HKCU\Environment\UserInitMprLogonScript to establish persistence.1 2

created 2017-05-31MALWAREcarried by 1 group

All 4 software entries for this technique

Offense vs defense T1037.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 1

first rule: 2019 Q1

Logon Script (Windows) detection strategy DET0072

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Logon Script Modifications and Execution

Enterprise

1 platform

AN0199 · Windows

Detects adversary use of logon script configuration via Group Policy or user object attributes, followed by script execution post-authentication. Behavior includes modification of script path or file, then process execution under user logon context.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Script ExecutionDC0029	WinEventLog:System	EventCode=1502, 1503
Process CreationDC0032	WinEventLog:Security	EventCode=4688
File AccessDC0055	WinEventLog:Security	EventCode=4663, 4670, 4656
Logon Session CreationDC0067	WinEventLog:Security	EventCode=4624, 4648

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
script_path_keywords	Defenders may tune for known script locations such as NETLOGON, SYSVOL, or \domain\sysvol\*.bat/.ps1
execution_time_window	May be scoped to user logon hours or first X minutes post-authentication
user_context	Organizations may focus on specific users/groups with high privilege or remote access

2 analytics

The Sysinternals tool Autoruns checks the registry and file system for known identify persistence mechanisms. It will output any tools identified, including built-in or added-on Microsoft functionality and third party software. Many of these locations are known by adversaries and used to obtain Persistence. Running Autoruns periodically in an environment makes it possible to collect and monitor its output for differences, which may include the removal or addition of persistent tools. Depending on the persistence mechanism and location, legitimate software may be more likely to make changes than an adversary tool. Thus, this analytic may result in significant noise in a highly dynamic environment. While Autoruns is a convenient method to scan for programs using persistence mechanisms its scanning nature does not conform well to streaming based analytics. This analytic could be replaced with one that draws from sensors that collect registry and file information if streaming analytics are desired.

TypesSituational Awareness, TTPCoverageModerateSubmitted2013

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-SICA	System Init Config Analysis

Adversaries may schedule software to run whenever a user logs into the system; this is done to establish persistence and sometimes for lateral movement. This trigger is established through the registry key HKEY_CURRENT_USER\Environment*UserInitMprLogonScript*. This signature looks edits to existing keys or creation of new keys in that path. Users purposefully adding benign scripts to this path will result in false positives; that case is rare, however. There are other ways of running a script at startup or login that are not covered in this signature. Note that this signature overlaps with the Windows Sysinternals Autoruns tool, which would also show changes to this registry path.

TypeTTPCoverageModerateSubmitted2020

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-SICA	System Init Config Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	command_line
process	create	exe
registry	add	key
registry	edit	key

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

This is a pseudocode representation of the below splunk search.

processes = search Process:Create
logon_script_key_processes = filter processes where (
  command_line = "*reg*add*\Environment*UserInitMprLogonScript")
registry = search (Registry:Add OR Registry:Edit)
registry_logon_key_events = filter registry where (
  key = "*\Environment*UserInitMprLogonScript")
output (logon_script_key_processes, registry_logon_key_events)

Look for commands for adding a logon script as a registry value, as well as direct registry events for the same thing.

(index=__your_sysmon_index__ EventCode=1 Image="C:\\Windows\\System32\\reg.exe" CommandLine="*add*\\Environment*UserInitMprLogonScript") OR (index=__your_sysmon_index__ (EventCode=12 OR EventCode=14 OR EventCode=13) TargetObject="*\\Environment*UserInitMprLogonScript")

Look for commands for adding a logon script as a registry value, as well as direct registry events for the same thing.

norm_id=WindowsSysmon ((event_id=1 image="C:\Windows\System32\reg.exe" command="*add*\Environment*UserInitMprLogonScript") OR (event_id IN [12, 13, 14] target_object="*\Environment*UserInitMprLogonScript"))

Tests1Executorscmd 1Need elevation0 of 1Have prerequisites0Have cleanup1Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Logon Scripts

windows

cmd

—

Yes

Adds a registry value to run batch script created in the %temp% directory. Upon execution, there will be a new environment variable in the HKCU\Environment key that can be viewed in the Registry Editor.

Input arguments

Name	Type	Default	Description
script_path	string	%temp%\art.bat	Path to .bat file
script_command	string	echo Art "Logon Script" atomic test was successful. >> %USERPROFILE%\desktop\T1037.001-log.txt	Command To Execute

Attack command

echo "#{script_command}" > #{script_path}
REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_SZ /d "#{script_path}" /f

Cleanup command

REG.exe DELETE HKCU\Environment /v UserInitMprLogonScript /f >nul 2>&1
del #{script_path} >nul 2>&1
del "%USERPROFILE%\desktop\T1037.001-log.txt" >nul 2>&1

GUIDf1ea0748-069b-4965-adb0-f75b9e14d0f8

Tests from Atomic Red Team (MIT licence) · technique definition

Logon Script (Windows) detections T1037.001

4 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

60th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs