Michael Haag
a6134b19c0
Technique: Hidden Files and Directories Technique: Logon Scripts - Source: https://github.com/NextronSystems/APTSimulator/blob/1c9048e834f0adabd18c8871d587fda42315575b/test-sets/persistence/userinit-mpr-logonscript.bat Readme updates
274 B
274 B
Logon Scripts
MITRE ATT&CK Technique: T1037
Input:
Add path and any command line variables--
REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_MULTI_SZ /d "<path of evil> <commandline switch of evil>"