ATT&CK technique
View on MITRE ATT&CK →
T1037.001
Logon Script (Windows)
PersistencePrivilege Escalation
4 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| splunk | Logon Script Event Trigger Execution | production | 2026-05-13 |
| sigma | Potential Persistence Via Logon Scripts - Registry | test | 2025-10-26 |
| sigma | Uncommon Userinit Child Process | test | 2023-11-14 |
| sigma | Potential Persistence Via Logon Scripts - CommandLine | test | 2023-06-09 |