MITRE ATT&CK Technique
T1037.001Logon Script (Windows)
- First Reported
- Sep 30, 2026
- Latest Reported
- Sep 30, 2026
Official Description
Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system.(Citation: TechNet Logon Scripts) This is done via adding a path to a script to the <code>HKCU\Environment\UserInitMprLogonScript</code> Registry key.(Citation: Hexacorn Logon Scripts)
Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
- Tactics
- Persistence, Privilege Escalation
- Platforms
- Windows
- Parent Technique
- T1037 · Boot or Logon Initialization Scripts
- MITRE Version
- 1.0
- Last Modified
- Oct 24, 2025
Reported Context (1)
- 2CLoader can use the UserInitMprLogonScript value under HKCU\Environment for persistence. 2CLoader Malware Loader Uses Evasion and Injection to Deliver Vidar and Remus
Malware (3)
MITRE ATT&CK (11)
Products (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.