Logon Script Modified via Remote Registry

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects attempts to modify a user's logon script via remote registry access. Specifically, it looks for TCP traffic on port 445 (SMB/CIFS, often used for remote registry) where the content "UserInitMprLogonScript" is present, indicating an attempt to alter this specific registry key. This activity is often associated with persistence techniques used by attackers to maintain access to a system.