HKCU UserinitMprLogonScript Registry Persistence
Detects modifications to the UserInitMprLogonScript registry value that point to suspicious locations or file types (e.g., AppData, .js, .vbs). This registry key is commonly used for persistence by executing a script at user logon. The rule excludes common legitimate paths like NETLOGON or SYSVOL.
Cortex XDR
