T1037.001 Logon Script Persistence UserInitMprLogonScript in Plaintext Traffic

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

Detects the transmission of the 'UserInitMprLogonScript' registry value name over SMB traffic in plaintext. This registry key is commonly used by adversaries to establish persistence by executing a logon script whenever a user logs in.