Potential Persistence Via Logon Scripts - Registry

SigmaHQ Detections@sigmaHQ

•updated Nov 26, 2025•0•0•2

Detects creation of "UserInitMprLogonScript" registry value which can be used as a persistence method by malicious actors