ATT&CK coverage › Technique

Boot or Logon Initialization Scripts: Logon Script (Windows) T1037.001

Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system. This is done via adding a path to a script to the <code>HKCU\Environment\UserInitMprLogonScript</code> Registry key.

Events covered

3 catalog events are tagged with this technique by at least one rule.

ProviderEvent IDTitle
Sysmon1Process creation
Sysmon13RegistryEvent (Value Set)
Security-Auditing4688A new process has been created.

Authoring guide

Patterns shared across the 4 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (5 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
CommandLine2match 2, eq 1UserInitMprLogonScript, PowerShell.exe, netlogon.bat, UsrLogon.cmd
TargetObject1match 1UserInitMprLogonScript
Image1ends_with 1, is_null 1:\Program Files\Citrix\HDX\bin\icast.exe, :\Program Files (x86)\Citrix\System32\icast.exe, :\Windows\System32\proquota.exe
ParentImage1ends_with 1\userinit.exe
registry_path1eq 1"*\\Environment\\UserInitMprLogonScript"

Top indicator values (16 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.

FieldKindValueRules (here)Corpus reach
CommandLinematchUserInitMprLogonScript1
TargetObjectmatchUserInitMprLogonScript1
Imageends_with:\Program Files\Citrix\HDX\bin\cmstart.exe1
Imageends_with:\Program Files (x86)\Citrix\HDX\bin\icast.exe1
CommandLinematchnetlogon.bat1
Imageends_with:\Windows\SysWOW64\proquota.exe1
Imageends_with:\WINDOWS\explorer.exe1
Imageends_with:\Program Files (x86)\Citrix\System32\icast.exe1
CommandLinematchUsrLogon.cmd1
Imageends_with:\Program Files (x86)\Citrix\HDX\bin\cmstart.exe1
ParentImageends_with\userinit.exe13
CommandLineeqPowerShell.exe1
Imageends_with:\Windows\System32\proquota.exe1
Imageends_with:\Program Files\Citrix\System32\icast.exe1
Imageends_with:\Program Files\Citrix\HDX\bin\icast.exe1
registry_patheq"*\\Environment\\UserInitMprLogonScript"1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 3 rules

Splunk 1 rule