Windows Command Line Logon Script Persistence via UserInitMprLogonScript

Alerts when a Windows process command line references UserInitMprLogonScript, a potential logon-script persistence indicator.

FreeUnreviewedSigmahighv1

windows-command-line-logon-script-persistence-via-userinitmprlogonscript-21d856f9

title: Windows Command Line Logon Script Persistence via UserInitMprLogonScript
id: 8c349da2-6cfe-4e9a-bcf9-b624cbf55a97
related:
  - id: 0a98a10c-685d-4ab0-bddc-b6bdd1d48458
    type: derived
  - id: 21d856f9-9281-4ded-9377-51a1a6e2a432
    type: derived
status: test
description: This rule flags process executions where the command line contains the registry value name "UserInitMprLogonScript", indicating an attempt to configure a logon script for persistence. Attackers can use logon script mechanisms to run code automatically at user sign-in. The detection relies on Windows process creation telemetry and matches the presence of that specific string in the process command line.
references:
  - https://cocomelonc.github.io/persistence/2022/12/09/malware-pers-20.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_registry_logon_script.yml
author: Tom Ueltschi (@c_APT_ure), Huntrule Team
date: 2019-01-12
modified: 2023-06-09
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1037.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: UserInitMprLogonScript
  condition: selection
falsepositives:
  - Legitimate addition of Logon Scripts via the command line by administrators or third party tools
level: high
license: DRL-1.1

What it detects

This rule flags process executions where the command line contains the registry value name "UserInitMprLogonScript", indicating an attempt to configure a logon script for persistence. Attackers can use logon script mechanisms to run code automatically at user sign-in. The detection relies on Windows process creation telemetry and matches the presence of that specific string in the process command line.

Known false positives

Legitimate addition of Logon Scripts via the command line by administrators or third party tools

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.