Windows Logon Scripts (UserInitMprLogonScript)

userinit.exe — the program Winlogon runs after every interactive logon — checks a per-user environment variable named UserInitMprLogonScript. If it exists, userinit executes whatever script or executable it points to, in the logging-on user’s context. MITRE tracks logon-script persistence under T1037.001 (Boot or Logon Initialization Scripts: Logon Script (Windows)).

Setting it up

The variable lives in the registry at HKCU\Environment — which means each user must be planted individually; there is no global equivalent. Create an expandable string value:

# REG_EXPAND_SZ so %VARS% in the path are expanded at logon
Set-ItemProperty -Path "HKCU:\Environment" `
    -Name "UserInitMprLogonScript" `
    -Value "C:\Users\Public\payload.bat" `
    -Type ExpandString

Equivalently via reg.exe:

reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\Users\Public\payload.bat"

The payload runs at the next logon of that user, with that user’s privileges — so planting it in a privileged user’s hive (after obtaining write access to it) turns a one-time compromise into recurring elevated execution.

Why it persists quietly

• The value sits in a per-user hive under a name most baseline audits don’t enumerate — Sysinternals Autoruns does flag it, but it is far less watched than the Run keys (see registry-run-keys-and-startup-folder).
• HKCU\Environment changes require no administrator rights for the current user — a low-privileged foothold can self-persist without any elevation.
• The execution path goes through userinit.exe, a signed, expected parent — the same logon chain documented in winlogon-autostart-values, but without touching the machine-wide Winlogon\Userinit value (which needs admin and is heavily monitored).

Detection

• Sysmon EID 13 (registry value set) on HKCU\Environment\UserInitMprLogonScript — near-zero false positives on servers.
• Process lineage: userinit.exe → script host / unexpected child at logon time.
• Harvest every profile hive: offline, mount each NTUSER.DAT and inspect Environment; online, reg query "HKU\<SID>\Environment" per logged-on SID.

Sources

• MITRE ATT&CK T1037.001 — Boot or Logon Initialization Scripts: Logon Script (Windows)
• MITRE ATT&CK T1037 — Boot or Logon Initialization Scripts

Related: winlogon-autostart-values, registry-run-keys-and-startup-folder, fodhelper-uac-bypass, runas-command