attack.t1037.001 | Detection.FYI

Potential Persistence Via Logon Scripts - CommandLine

Aug 12, 2024 · attack.persistence attack.t1037.001 ·
Share on:

Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence

Read More
Potential Persistence Via Logon Scripts - Registry

Aug 12, 2024 · attack.t1037.001 attack.persistence attack.lateral-movement ·
Share on:

Detects creation of "UserInitMprLogonScript" registry value which can be used as a persistence method by malicious actors

Read More
Uncommon Userinit Child Process

Aug 12, 2024 · attack.t1037.001 attack.persistence ·
Share on:

Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for persistence.

Read More