title: Logon Scripts (UserInitMprLogonScript) Registry
id: 9ace0707-b560-49b8-b6ca-5148b42f39fb
status: experimental
description: Detects creation or execution of UserInitMprLogonScript persistence method
references:
    - https://attack.mitre.org/techniques/T1037/
tags:
    - attack.t1037
    - attack.t1037.001
    - attack.persistence
    - attack.lateral_movement
author: Tom Ueltschi (@c_APT_ure)
date: 2019/01/12
modified: 2020/07/01
logsource:
    category: registry_event
    product: windows
detection:
    create_keywords_reg:
        TargetObject: '*UserInitMprLogonScript*'
    condition: create_keywords_reg
falsepositives:
    - exclude legitimate logon scripts
    - penetration tests, red teaming
level: high