T1037.001 Logon Script (Windows)

Technique

T1037.001

Tactics

Persistence, Privilege Escalation

Research, 90 days

1

KEV CVEs mapped

0

SigmaHQ rules

3

Elastic, Splunk

1

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1037/001

MITRE description

Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system.(Citation: TechNet Logon Scripts) This is done via adding a path to a script to the <code>HKCU\Environment\UserInitMprLogonScript</code> Registry key.(Citation: Hexacorn Logon Scripts) Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-22 Group-IB: Inside SiriusQT: A Seriously Skilled RAT

Detection coverage

SigmaHQ community rules

• Potential Persistence Via Logon Scripts - CommandLine (core)
• Uncommon Userinit Child Process (core)
• Potential Persistence Via Logon Scripts - Registry (core)

Elastic and Splunk rules

• Logon Script Event Trigger Execution (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.