UserInitMprLogonScript Persistence

This procedure will add the pneuma agent to the UserInitMprLogonScript registry key. Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system.
View Command

You must be logged in to view this TTPs command.


Test this TTP

Download Operator (1.7.1)