Detect Logon Script (Windows) in Elastic Security
Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system. This is done via adding a path to a script to the HKCU\Environment\UserInitMprLogonScript Registry key. Adversaries such as APT28, Cobalt Group, and malware families including Attor, JHUHUGIT, KGH_SPY, and Zebrocy have all leveraged this technique to maintain persistence on compromised systems.
MITRE ATT&CK
- Tactic
- Persistence Privilege Escalation
- Sub-technique
- T1037.001 Logon Script (Windows)
- Canonical reference
- https://attack.mitre.org/techniques/T1037/001/
Elastic Detection Query
sequence by host.name
[registry where registry.path : "*\\Environment\\UserInitMprLogonScript" and
(event.action == "modification" or event.action == "creation") and
registry.data.strings : ("*.bat", "*.cmd", "*.ps1", "*.vbs", "*.js", "*.exe", "*.hta", "*.wsf", "*.scr", "*AppData*", "*Temp*", "*Users\\*", "*ProgramData*")]
[process where event.type == "start" and
(process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe") or
process.parent.name : ("userinit.exe", "explorer.exe"))]
// Alternative single-event detection for registry modification
registry where
registry.path : "*\\HKEY_USERS\\*\\Environment\\UserInitMprLogonScript" or
registry.path : "*\\HKCU\\Environment\\UserInitMprLogonScript" and
(event.action == "modification" or event.action == "creation") and
not registry.data.strings : ("C:\\Windows\\*", "C:\\Program Files\\*")Detects modification or creation of the HKCU\Environment\UserInitMprLogonScript registry value, which is used by adversaries to execute scripts at logon for persistence. Correlates registry writes with suspicious script extensions or writable user paths, and optionally sequences with child process launch from userinit.exe.
Data Sources
Required Tables
False Positives & Tuning
- Enterprise logon management software (e.g., Citrix, VMware Workspace ONE) may legitimately set UserInitMprLogonScript for session initialization
- IT administrators using Group Policy or logon script management tools to deploy authorized scripts via this registry key
- Software deployment tools (SCCM, Intune) that temporarily write logon scripts during package deployment workflows
Other platforms for T1037.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Set UserInitMprLogonScript via reg.exe
Expected signal: Sysmon Event ID 13: TargetObject=HKEY_CURRENT_USER\Environment\UserInitMprLogonScript, Details=%TEMP%\logon_test.bat, Image=C:\Windows\System32\reg.exe. Sysmon Event ID 11: File creation of logon_test.bat in %TEMP%. Security Event ID 4688: Process creation for reg.exe with command line containing 'add HKCU\Environment /v UserInitMprLogonScript'.
- Test 2Set UserInitMprLogonScript via PowerShell Registry Provider
Expected signal: Sysmon Event ID 13: TargetObject=HKEY_CURRENT_USER\Environment\UserInitMprLogonScript, Details path ending in T1037001_test.ps1, Image=powershell.exe. Sysmon Event ID 11: File creation of T1037001_test.ps1 in %TEMP%. PowerShell ScriptBlock Log Event ID 4104: Contains 'Set-ItemProperty' and 'UserInitMprLogonScript'. DeviceRegistryEvents: RegistryValueName=UserInitMprLogonScript, InitiatingProcessFileName=powershell.exe.
- Test 3Set UserInitMprLogonScript via .NET Registry API (Fileless Technique)
Expected signal: Sysmon Event ID 13: TargetObject=HKEY_CURRENT_USER\Environment\UserInitMprLogonScript, Details path ending in T1037001_logon.vbs in AppData\Microsoft, Image=powershell.exe. Sysmon Event ID 11: File creation of T1037001_logon.vbs in AppData\Microsoft. PowerShell ScriptBlock Log Event ID 4104: Contains 'Microsoft.Win32.Registry' and 'UserInitMprLogonScript'. Note: The initiating process is still powershell.exe even though reg.exe is not spawned.
- Test 4Simulate Logon Script Execution via userinit.exe Process Chain
Expected signal: Sysmon Event ID 13: Registry value set for UserInitMprLogonScript. Sysmon Event ID 1: Process creation for cmd.exe executing the batch file. Sysmon Event ID 11: Creation of T1037001_executed.txt marker file. Security Event ID 4688: cmd.exe process creation with command line referencing T1037001_exec_test.bat. On actual logon, the parent would be userinit.exe rather than the test process.
References (10)
- https://attack.mitre.org/techniques/T1037/001/
- http://www.hexacorn.com/blog/2014/11/14/beyond-good-ol-run-key-part-18/
- https://technet.microsoft.com/en-us/library/cc758918(v=ws.10).aspx
- https://unit42.paloaltonetworks.com/unit42-playbook-viewer/
- https://www.welivesecurity.com/2019/10/10/eset-attor-spy-platform/
- https://www.welivesecurity.com/2018/11/20/sednit-what-happened-zebrocy/
- https://blog.morphisec.com/cobalt-gang-2.0
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1037.001/T1037.001.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_logon_script_userinitmpr.yml
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4657
Unlock Pro Content
Get the full detection package for T1037.001 including response playbook, investigation guide, and atomic red team tests.