Logon Script (Windows) is ATT&CK T1037.001. It is mapped to Persistence and Privilege Escalation and applies to Windows. It is the per-user form of logon scripts, set through a registry value.
How attackers use it
MITRE explains that Windows can run logon scripts whenever a specific user or group of users logs on. This is done by adding the path to a script under the registry key HKCU\Environment\UserInitMprLogonScript. An adversary who can write to that value gets code execution at each logon of that user. Depending on how access to the script is configured, local credentials or an administrator account may be needed.
The registry location is the same in every case in the procedure examples. Several malware families and groups are listed as setting that exact key to register the next stage of their code, including a loader, a dispatcher component and a spyware family.
How to detect it
The MITRE analytic describes logon script configuration through Group Policy or user object attributes, followed by execution of the script after authentication. The behavior pattern is: the script path or file is modified, then a process runs under the logon context.
Sysmon registry events, such as event ID 13 for a registry value set, can capture a write to this value. Pair that with process creation events for logon time. Alert on any write to UserInitMprLogonScript that is not part of a documented change.
How to reduce the risk
MITRE lists one mitigation: restrict registry permissions. Make sure registry hive permissions prevent users from modifying keys for logon scripts that may lead to persistence. If you manage logon scripts with Group Policy, keep them there and treat the registry route as unexpected.
Check your own environment
Read the value for the current user. In most cases it does not exist:
reg query HKCU\Environment /v UserInitMprLogonScript
For a fleet, query the same key through your endpoint management tool, and compare against a list of approved scripts.
Quick check
Which registry value does this sub-technique use?
UserInitMprLogonScript, under HKCU\Environment.
