> Technique · Userinit Registry Persistence_

~/packetpursuit $ cat /intel/techniques/userinit-registry-persistence.md

typetechniquecreated2026-07-03updated2026-07-03persistenceregistryboot-logon

Userinit Registry Persistence

Appending a payload path to the Userinit registry value under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, causing the payload to execute every time a user logs on.

Method

  1. Open HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.^[r2:fcn.140005090]
  2. Read the existing Userinit value (normally C:\Windows\system32\userinit.exe).
  3. Append the payload path (e.g. protocol.exe) separated by a comma.
  4. Write the modified value back using RegSetValueExW.^[strings.txt:10354]

Detection Notes

  • The Userinit value should only contain userinit.exe. Any comma-separated additional paths are suspicious.
  • Monitor RegSetValueExW on Winlogon\Userinit.

Capabilities

  • userinit-registry-persistence