CmdID / Techniques / T1037

T1037.001 Boot or Logon Initialization Scripts: Logon Script (Windows)

Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. MITRE ATT&CK

2 Sigma rules T1037.001 on attack.mitre.org