Hide Navigation Hide TOC

Potential Persistence Via Logon Scripts - CommandLine (21d856f9-9281-4ded-9377-51a1a6e2a432)

Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Logon Script (Windows) - T1037.001 (eb125d40-0b2d-41ac-a71a-3229241c2cd3)	Attack Pattern	Potential Persistence Via Logon Scripts - CommandLine (21d856f9-9281-4ded-9377-51a1a6e2a432)	Sigma-Rules	1
Logon Script (Windows) - T1037.001 (eb125d40-0b2d-41ac-a71a-3229241c2cd3)	Attack Pattern	Boot or Logon Initialization Scripts - T1037 (03259939-0b57-482f-8eb5-87c0e0d54334)	Attack Pattern	2