huntrule

Windows Command Line Logon Script Persistence via UserInitMprLogonScript

Alerts when a Windows process command line references UserInitMprLogonScript, a potential logon-script persistence indicator.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Tom Ueltschi (@c_APT_ure) (SigmaHQ), DRL 1.1
Published
2019-01-12
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Persistence → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process executions where the command line contains the registry value name "UserInitMprLogonScript", indicating an attempt to configure a logon script for persistence. Attackers can use logon script mechanisms to run code automatically at user sign-in. The detection relies on Windows process creation telemetry and matches the presence of that specific string in the process command line.

Reporting behind it

Related detections4 linkedT1037.001 — drag to rearrange
Malicious Logon Script Persistence via UserInitMprLogonScript
Suspicious COLDRIVER Logon Script Persistence via UserInitMprLogonScript (via process_creation)
Windows userinit.exe Spawns Uncommon Child Processes
Windows Registry Persistence via UserInitMprLogonScript Value
Windows Command Line Logon Script Persistence via UserInitMprLogonScript
Pivot detection · T1037.001 · 4 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.