Potential Persistence Via Logon Scripts - CommandLine

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•36

Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" via command line, which can be used for persistence.