What is the registry path and key used for Logon Script persistence?

The persistence technique uses the registry path HKCU\Environment and creates a string value named UserInitMprLogonScript, set to the absolute path of a batch script (e.g., c:\test\11.bat). Upon user logon, the script executes automatically. --- **Related reading:** - [Use Logon Scripts to maintain persistence](/news/use-logon-scripts-to-maintain-persistence) — original article - [Penetration Basics - Obfuscating Strings Using Unicode Encoding](/news/penetration-basics-obfuscating-strings-using-unicode-encoding) - [Sophos UTM Analysis - Clearing Last WebAdmin Sessions Records](/news/sophos-utm-analysis-clearing-last-webadmin-sessions-records) - [Penetration Basics - Methods to Continuously Obtain Exchange User Inbox Emails](/news/penetration-basics-methods-to-continuously-obtain-exchange-user-inbox-emails)