Windows Registry Persistence via UserInitMprLogonScript Value

Detects registry value name containing "UserInitMprLogonScript", which may indicate logon-script persistence setup.

FreeUnreviewedSigmamediumv1

windows-registry-persistence-via-userinitmprlogonscript-value-9ace0707

title: Windows Registry Persistence via UserInitMprLogonScript Value
id: bd93bdd7-3703-4841-a3a7-6f702464b6f6
status: test
description: This rule flags the creation or modification of a registry value containing the string "UserInitMprLogonScript". Attackers can use logon-script related registry values to establish persistence and execute actions when a user logs in. The detection relies on registry set telemetry that records the targeted value name via its TargetObject field.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1037.001/T1037.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_logon_scripts_userinitmprlogonscript.yml
author: Tom Ueltschi (@c_APT_ure), Huntrule Team
date: 2019-01-12
modified: 2025-10-26
tags:
  - attack.privilege-escalation
  - attack.t1037.001
  - attack.persistence
  - attack.lateral-movement
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: UserInitMprLogonScript
  condition: selection
falsepositives:
  - Investigate the contents of the "UserInitMprLogonScript" value to determine of the added script is legitimate
level: medium
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_persistence_logon_scripts_userinitmprlogonscript/info.yml
simulation:
  - type: atomic-red-team
    name: Logon Scripts
    technique: T1037.001
    atomic_guid: d6042746-07d4-4c92-9ad8-e644c114a231
license: DRL-1.1
related:
  - id: 9ace0707-b560-49b8-b6ca-5148b42f39fb
    type: derived

What it detects

This rule flags the creation or modification of a registry value containing the string "UserInitMprLogonScript". Attackers can use logon-script related registry values to establish persistence and execute actions when a user logs in. The detection relies on registry set telemetry that records the targeted value name via its TargetObject field.

Known false positives

Investigate the contents of the "UserInitMprLogonScript" value to determine of the added script is legitimate

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.