Boot or Logon Initialization Scripts

Hypothesis and description

Adversaries may schedule software to run whenever a user logs into the system; this is done to establish persistence and sometimes for lateral movement. This trigger is established through the registry key HKEY_CURRENT_USER\Environment*UserInitMprLogonScript*. This signature looks edits to existing keys or creation of new keys in that path. Users purposefully adding benign scripts to this path will result in false positives; that case is rare, however. There are other ways of running a script at startup or login that are not covered in this signature. Note that this signature overlaps with the Windows Sysinternals Autoruns tool, which would also show changes to this registry path.

Platforms: Windows
Domain: Host
Subtypes: Registry, Process
Submitted: 2020-11-30
Contributors: Olaf Hartong

ATT&CK coverage

Technique	Tactics	Coverage
T1037 Boot or Logon Initialization ScriptsT1037.001	Persistence, Lateral Movement	Moderate

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1037Boot or Logon Initialization Scripts
.001 Logon Script (Windows)

D3FEND techniques MITRE maps to this analytic

D3-SICA System Init Config Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

PseudocodePseudocode - logon run script key added to registry using reg.exe on commandline, or new logon scipt keys in registry from any source.Data model: CAR native

This is a pseudocode representation of the below splunk search.

processes = search Process:Create
logon_script_key_processes = filter processes where (
  command_line = "*reg*add*\Environment*UserInitMprLogonScript")
registry = search (Registry:Add OR Registry:Edit)
registry_logon_key_events = filter registry where (
  key = "*\Environment*UserInitMprLogonScript")
output (logon_script_key_processes, registry_logon_key_events)

SplunkSplunk Search -- logon scriptsData model: Sysmon native

Look for commands for adding a logon script as a registry value, as well as direct registry events for the same thing.

(index=__your_sysmon_index__ EventCode=1 Image="C:\\Windows\\System32\\reg.exe" CommandLine="*add*\\Environment*UserInitMprLogonScript") OR (index=__your_sysmon_index__ (EventCode=12 OR EventCode=14 OR EventCode=13) TargetObject="*\\Environment*UserInitMprLogonScript")

LogPointLogPoint Search -- logon scriptsData model: LogPoint native

Look for commands for adding a logon script as a registry value, as well as direct registry events for the same thing.

norm_id=WindowsSysmon ((event_id=1 image="C:\Windows\System32\reg.exe" command="*add*\Environment*UserInitMprLogonScript") OR (event_id IN [12, 13, 14] target_object="*\Environment*UserInitMprLogonScript"))

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

8 more in the full list

View CAR-2020-11-001 on car.mitre.org

Hypothesis and description

Technique

Tactics

Coverage

T1037 Boot or Logon Initialization ScriptsT1037.001

Persistence, Lateral Movement

Moderate

Pseudocode and implementations

PseudocodePseudocode - logon run script key added to registry using reg.exe on commandline, or new logon scipt keys in registry from any source.Data model: CAR native

This is a pseudocode representation of the below splunk search.

processes = search Process:Create
logon_script_key_processes = filter processes where (
  command_line = "*reg*add*\Environment*UserInitMprLogonScript")
registry = search (Registry:Add OR Registry:Edit)
registry_logon_key_events = filter registry where (
  key = "*\Environment*UserInitMprLogonScript")
output (logon_script_key_processes, registry_logon_key_events)

SplunkSplunk Search -- logon scriptsData model: Sysmon native

Look for commands for adding a logon script as a registry value, as well as direct registry events for the same thing.

(index=__your_sysmon_index__ EventCode=1 Image="C:\\Windows\\System32\\reg.exe" CommandLine="*add*\\Environment*UserInitMprLogonScript") OR (index=__your_sysmon_index__ (EventCode=12 OR EventCode=14 OR EventCode=13) TargetObject="*\\Environment*UserInitMprLogonScript")

LogPointLogPoint Search -- logon scriptsData model: LogPoint native

Look for commands for adding a logon script as a registry value, as well as direct registry events for the same thing.

norm_id=WindowsSysmon ((event_id=1 image="C:\Windows\System32\reg.exe" command="*add*\Environment*UserInitMprLogonScript") OR (event_id IN [12, 13, 14] target_object="*\Environment*UserInitMprLogonScript"))