T1037.001 — Logon Script (Windows)

Tactics: Persistence, Privilege Escalation · Platforms: Windows

Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system. This is done via adding a path to a script to the…

Sub-technique of Boot or Logon Initialization Scripts (T1037).

Sigma detection rules (1)

T1037.001 Boot or Logon Initialization Scripts: Logon Script (Windows)

title: "T1037.001 Boot or Logon Initialization Scripts: Logon Script (Windows)"
id: de8342e6-f1ae-4141-b6ce-2676f941565a
description: 'Detect Logon Script Modifications and Execution. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: script_path_keywords, execution_time_window, user_context.'
references:
  - https://attack.mitre.org/techniques/T1037/001
author: Shahrukh Khan
date: 2026-04-14
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1037.001

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    ParentImage|endswith: '\userinit.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'

  condition: selection

falsepositives:
  - Legitimate, IT-deployed logon scripts via Group Policy will also match; baseline expected logon-script executables and filter them out explicitly.

level: medium

Related sub-techniques

Explore