Boot or Logon Initialization Scripts: Logon Script (Windows)
- ID
- T1037.001
- Tactics
- TA0003 Persistence, TA0004 Privilege Escalation
- Sub-technique of
- T1037 Boot or Logon Initialization Scripts
- Platforms
- Windows
- Data sources
- File Access, Script Execution, Logon Session Creation, Process Creation
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system.[1] This is done via adding a path to a script to the HKCU\Environment\UserInitMprLogonScript Registry key.[2]
Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
Detection
- DET0072 Detect Logon Script Modifications and Execution
Data components: File Access, Script Execution, Logon Session Creation, Process Creation
Mitigations (1)
- M1024 Restrict Registry Permissions
Ensure proper permissions are set for Registry hives to prevent users from modifying keys for logon scripts that may lead to persistence.