Logon initialisation spawns a process other than the shell

1title: Logon initialisation spawns a process other than the shell2id: 8df64ad3-948c-45d0-9443-b86f4ae096a53status: experimental4description: |5  T1037.001 is the `HKCU\Environment\UserInitMprLogonScript` value, and the6  process that runs whatever that value points at is `userinit.exe` — so this7  rule gates on `userinit.exe` as the parent and treats any child that is not8  the shell as the hit, rather than listing script interpreters, because the9  value can name an executable directly. The same gate also covers AN0199's10  other configuration path, a script named by the user object's `scriptPath`11  attribute. Two exclusions shape it: the shell, pinned to12  `\Windows\explorer.exe` rather than to any file named explorer.exe so that a13  payload dropped under that name elsewhere is still a hit, and a command line14  naming one of the domain script shares, because `scriptPath` resolves against15  NETLOGON and the ordinary domain logon script would otherwise match at every16  logon. MITRE's `script_path_keywords` knob names NETLOGON and SYSVOL as paths17  to tune on; it is used inversely here, populated with those two share names as18  a suppression rather than a selection, and the cost of that choice is that a19  script an adversary stages on either share is outside this rule's reach. The20  exclusion is the two share names rather than "any UNC prefix" on purpose: the21  command line is written by whoever set the registry value, so a blanket22  contains-`\\` filter would let any value carrying a UNC-shaped string —23  `\\127.0.0.1\C$\Users\Public\p.bat` for a purely local file — silence the24  whole rule.25  The brief maps Security EventID 4688 onto Sigma's `process_creation`26  category, which is Sysmon-shaped — this rule is written in that vocabulary27  (`Image`, `ParentImage`, `CommandLine`), and a raw 4688 feed, whose native28  names are `NewProcessName` and `ParentProcessName`, needs the usual field29  mapping applied before it can match. 4688 also needs *Audit Process30  Creation*, and the share exclusion additionally needs the separate *Include31  command line in process creation events* policy; without it `CommandLine` is32  absent, nothing is suppressed and the rule gets noisier rather than quieter.33  AN0199's Group Policy half — `gpscript.exe` and System 1502/1503 — is not34  used: those scripts run from the local Group Policy cache at every logon, and35  configuring them is Group Policy modification rather than the per-user36  registry value this technique defines.37  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0072, not hand-written and not tested by its author. Any lab result is on this rule's own page.38references:39  - https://attack.mitre.org/techniques/T1037/00140  - https://attack.mitre.org/detectionstrategies/DET007241author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)42date: 2026-08-1643tags:44  - attack.persistence45  - attack.privilege-escalation46  - attack.t1037.00147logsource:48  category: process_creation49  product: windows50detection:51  selection_logon_init:52    ParentImage|endswith: '\userinit.exe'53  filter_shell:54    Image|endswith: '\Windows\explorer.exe'55  filter_domain_share:56    CommandLine|contains:57      - '\\netlogon\\'58      - '\\sysvol\\'59  condition: selection_logon_init and not filter_shell and not filter_domain_share60falsepositives:61  - "Endpoint-management, drive-mapping and printer-deployment products that hook logon by writing UserInitMprLogonScript or a local logon script themselves, which is the same mechanism this technique uses and fires at every logon on every host carrying the agent. This is the highest-volume match by a wide margin and is why the rule is low rather than medium."62  - "Estates that still run a per-user logon script served from an ordinary file share or copied to a local path such as C:\\ProgramData rather than from NETLOGON or SYSVOL, where the share exclusion does not apply and userinit.exe launches the script at each affected user's logon."63  - "Kiosk and task-station builds that replace the shell, so the configured application starts under userinit.exe instead of explorer.exe and falls outside the shell exclusion on every logon."64  - "Software installers and repair tasks that queue work to run at next logon through the same per-user logon script value, producing a single match on the following logon."65level: low