Windows Registry Persistence via UserInitMprLogonScript Value
Detects registry value name containing "UserInitMprLogonScript", which may indicate logon-script persistence setup.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- registry_set
- Author
- Tom Ueltschi (@c_APT_ure) (SigmaHQ), DRL 1.1
- Published
- 2019-01-12
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags the creation or modification of a registry value containing the string "UserInitMprLogonScript". Attackers can use logon-script related registry values to establish persistence and execute actions when a user logs in. The detection relies on registry set telemetry that records the targeted value name via its TargetObject field.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-persistence-via-userinitmprlogonscript-value-9ace0707
title: Windows Registry Persistence via UserInitMprLogonScript Value
id: bd93bdd7-3703-4841-a3a7-6f702464b6f6
status: test
description: This rule flags the creation or modification of a registry value containing the string "UserInitMprLogonScript". Attackers can use logon-script related registry values to establish persistence and execute actions when a user logs in. The detection relies on registry set telemetry that records the targeted value name via its TargetObject field.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1037.001/T1037.001.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_logon_scripts_userinitmprlogonscript.yml
author: Tom Ueltschi (@c_APT_ure), Huntrule Team
date: 2019-01-12
modified: 2025-10-26
tags:
- attack.privilege-escalation
- attack.t1037.001
- attack.persistence
- attack.lateral-movement
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: UserInitMprLogonScript
condition: selection
falsepositives:
- Investigate the contents of the "UserInitMprLogonScript" value to determine of the added script is legitimate
level: medium
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_persistence_logon_scripts_userinitmprlogonscript/info.yml
simulation:
- type: atomic-red-team
name: Logon Scripts
technique: T1037.001
atomic_guid: d6042746-07d4-4c92-9ad8-e644c114a231
license: DRL-1.1
related:
- id: 9ace0707-b560-49b8-b6ca-5148b42f39fb
type: derived