attack.t1037.001 | Detection.FYI

Uncommon Userinit Child Process

Nov 15, 2023 · attack.t1037.001 attack.persistence ·
Share on:

Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for persistence.

Read More
Potential Persistence Via Logon Scripts - CommandLine

Jun 9, 2023 · attack.persistence attack.t1037.001 ·
Share on:

Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence

Read More
Potential Persistence Via Logon Scripts - Registry

Jun 9, 2023 · attack.t1037.001 attack.persistence attack.lateral_movement ·
Share on:

Detects creation of "UserInitMprLogonScript" registry value which can be used as a persistence method by malicious actors

Read More