attack.t1037.001 | Detection.FYI

Potential Persistence Via Logon Scripts - Registry

Nov 26, 2025 · attack.privilege-escalation attack.t1037.001 attack.persistence attack.lateral-movement ·
Share on:

Detects creation of "UserInitMprLogonScript" registry value which can be used as a persistence method by malicious actors

Read More
Potential Persistence Via Logon Scripts - CommandLine

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1037.001 ·
Share on:

Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence

Read More
Uncommon Userinit Child Process

Oct 23, 2025 · attack.privilege-escalation attack.t1037.001 attack.persistence ·
Share on:

Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for persistence.

Read More