Potential Persistence Via Logon Scripts - Registry

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•16

Detects the creation of the 'UserInitMprLogonScript' registry value, which can be leveraged by adversaries to establish persistence on a system. This registry key is designed to execute a script upon user logon, making it a valuable target for malicious actors seeking to maintain access.