Michael Haag
a6134b19c0
Technique: Hidden Files and Directories Technique: Logon Scripts - Source: https://github.com/NextronSystems/APTSimulator/blob/1c9048e834f0adabd18c8871d587fda42315575b/test-sets/persistence/userinit-mpr-logonscript.bat Readme updates
11 lines
274 B
Markdown
11 lines
274 B
Markdown
## Logon Scripts
|
|
|
|
MITRE ATT&CK Technique: [T1037](https://attack.mitre.org/wiki/Technique/T1037)
|
|
|
|
|
|
Input:
|
|
|
|
Add path and any command line variables--
|
|
|
|
REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_MULTI_SZ /d "<path of evil> <commandline switch of evil>"
|