What MITRE ATT&CK T1037.001: Logon Script (Windows) (Enterprise Tactic TA0003 - Persistence / TA0004 - Privilege Escalation) requires
MITRE ATT&CK T1037.001 (Logon Script (Windows)) is an Enterprise Persistence and Privilege Escalation sub-technique of T1037 (Boot or Logon Initialization Scripts). Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system. This is done via adding a path to a script to the HKCU\Environment\UserInitMprLogonScript Registry key. Adversaries may use these scripts to maintain persistence on a single system. Affected platforms: Windows. MITRE-documented mitigations include M1024 Restrict Registry Permissions. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-03, AC-17, CA-07, CM-02, CM-06, CM-07, SI-03, SI-04.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1037/001/
SHA-256 integrity: 46745885801bf20ef99777ed4b987cc2cccb5e16831e7ee7497f6874136ec947
Primary Citations — 7 traced to source
- MITRE ATT&CK Technique T1037.001: Logon Script (Windows) (https://attack.mitre.org/techniques/T1037/001/)
- MITRE ATT&CK Tactic TA0003: Persistence (https://attack.mitre.org/tactics/TA0003/)
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/mitre-attack-t1037-001-logon-script-windows.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/mitre-attack-t1037-001-logon-script-windows.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/mitre-attack-t1037-001-logon-script-windows
- Back to registry: Browse all 10,085 compliance nodes