# T1037.001 - Logon Script (Windows)
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1037/001)
<blockquote>Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system.(Citation: TechNet Logon Scripts) This is done via adding a path to a script to the <code>HKCU\Environment\UserInitMprLogonScript</code> Registry key.(Citation: Hexacorn Logon Scripts)

Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. </blockquote>

## Atomic Tests

- [Atomic Test #1 - Logon Scripts](#atomic-test-1---logon-scripts)


<br/>

## Atomic Test #1 - Logon Scripts
Adds a registry value to run batch script created in the %temp% directory. Upon execution, there will be a new environment variable in the HKCU\Environment key
that can be viewed in the Registry Editor.

**Supported Platforms:** Windows


**auto_generated_guid:** d6042746-07d4-4c92-9ad8-e644c114a231





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| script_path | Path to .bat file | String | %temp%&#92;art.bat|
| script_command | Command To Execute | String | echo Art "Logon Script" atomic test was successful. >> %USERPROFILE%&#92;desktop&#92;T1037.001-log.txt|


#### Attack Commands: Run with `command_prompt`! 


```cmd
echo "#{script_command}" > #{script_path}
REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_SZ /d "#{script_path}" /f
```

#### Cleanup Commands:
```cmd
REG.exe DELETE HKCU\Environment /v UserInitMprLogonScript /f >nul 2>&1
del #{script_path} >nul 2>&1
del "%USERPROFILE%\desktop\T1037.001-log.txt" >nul 2>&1
```





<br/>
