Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
29 detections
Filters
Last updated
All Time
Detection languages
12
7
4
2
2
Contributors
6
6
5
4
4
Categories
8
8
5
4
4
Platforms
29
4
Products / Services
7
6
4
2
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
2
2
IDS Protocols
3
1
Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence
Detects creation of "UserInitMprLogonScript" registry value which can be used as a persistence method by malicious actors
Detects creation of "UserInitMprLogonScript" registry value which can be used as a persistence method by malicious actors
Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence
Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for persistence.
Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for persistence.
The following analytic detects the modification of the UserInitMprLogonScript registry entry, which is often used by attackers to establish persistence and gain privilege escalation upon system boot. It leverages data from the Endpoint.Registry data model, focusing on changes to the specified registry path. This activity is significant because it is a common technique used by APT groups and malware to ensure their payloads execute automatically when the system starts. If confirmed malicious, this could allow attackers to maintain persistent access and potentially escalate their privileges on the compromised host.
Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence
Page 2 of 2