Query: detect Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence in logs
Matching passage: Sigma rule: Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence. Logsource: windows / process_creation. Rule: title: Potential Persistence Via Logon Scripts - CommandLine id: 21d856f9-9281-4ded-9377-51a1a6e2a432 related: - id: 0a98a10c-685d-4ab0-bddc-b6bdd1d48458 type: derived status: test description: Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence references: - https://cocomelonc.github.io/persistence/2022/12/09/malware-pers-20.html author: Tom Ueltschi (@c_APT_ure) date: 2019-01-12 modified: 2023-06-09 tags: - attack.privilege-escalation - attack.persistence - attack.t1037.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: UserInitMprLogonScript condition: selection falsepositives: - Legitimate addition of Logon Scripts via the command line by administrators or third party tools level: high
Near-miss passage: Sigma rule: Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.. Logsource: windows / image_load. Rule: title: Suspicious WSMAN Provider Image Loads id: ad1f4bb9-8dfb-4765-adb6-2a7cfb6c0f94 status: test description: Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution. references: - https://twitter.com/chadtilbury/status/1275851297770610688 - https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/ - https://learn.microsoft.com/en-us/windows/win32/winrm/windows-remote-management-architecture - https://github.com/bohops/WSMan-WinRM author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-06-24 modified: 2026-07-28 tags: - attack.execution - attack.t1059.001 - attack.lateral-movement - attack.t1021.003 logsource: category: image_load product: windows detection: request_client: - ImageLoaded|endswith: - \WsmSvc.dll - \WsmAuto.dll - \Microsoft.WSMan.Management.ni.dll - OriginalFileName: - WsmSvc.dll - WSMANAUTOMATION.DLL - Microsoft.WSMan.Management.dll respond_server: Image|endswith: \svchost.exe OriginalFileName: WsmWmiPl.dll filter_general: Image: - C:\Program Files (x86)\PowerShell\6\pwsh.exe - C:\Program Files (x86)\PowerShell\7\pwsh.exe - C:\Program Files\PowerShell\6\pwsh.exe - C:\Program Files\PowerShell\7\pwsh.exe - C:\Windows\System32\sdiagnhost.exe - C:\Windows\System32\services.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe filter_svchost: CommandLine|contains: - svchost.exe -k netsvcs -p -s BITS - svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc - svchost.exe -k NetworkService -p -s Wecsvc - svchost.exe -k netsvcs filter_mscorsvw: Image|startswith: - C:\Windows\Microsoft.NET\Framework64\v - C:\Windows\Microsoft.NET\Framework\v - C:\Windows\Microsoft.NET\FrameworkArm\v - C:\Windows\Microsoft.NET\FrameworkArm64\v Image|endswith: \mscorsvw.exe filter_gethelp: Image|startswith: C:\Program Files\WindowsApps\Microsoft.GetHelp_ Image|endswith: \GetHelp.exe filter_svr_2019: Image: - C:\Windows\System32\Configure-SMRemoting.exe - C:\Windows\System32\ServerManager.exe filter_nextron: Image|startswith: C:\Windows\Temp\asgard2-agent\ filter_citrix: Image|startswith: C:\Program Files\Citrix\ filter_upgrade: Image|startswith: C:\$WINDOWS.~BT\Sources\ filter_mmc: Image|endswith: \mmc.exe svchost: Image|endswith: \svchost.exe commandline_null: CommandLine: null condition: ( request_client or respond_server ) and not 1 of filter* and not ( svchost and commandline_null ) f