DFIRHub

Windows registry artifactWinLogon UserInit

Userinit.exe is launched by winlogon.exe and runs logon scripts for the user, reestablishes network connections, and then starts Explorer.exe. It also specifies programs Winlogon should run when a user logs on. Typically contains 'userinit.exe,'.

  • Threat Hunting
  • 3 keys
  • NTUSERSOFTWARE

Registry keys

3 keys that RECmd reads for this artifact

  • NTUSERUserinit
    SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon

    Userinit.exe is launched by winlogon.exe and runs logon scripts for the user, reestablishes network connections, and then starts Explorer.exe. It also specifies programs Winlogon should run when a user logs on. Typically contains 'userinit.exe,'.

  • SOFTWAREUserinit
    Microsoft\Windows NT\CurrentVersion\WinLogon

    Userinit.exe is launched by winlogon.exe and runs logon scripts for the user, reestablishes network connections, and then starts Explorer.exe. It also specifies programs Winlogon should run when a user logs on. Typically contains 'userinit.exe,'.

  • SOFTWAREUserinit
    WOW6432Node\Microsoft\Windows NT\CurrentVersion\WinLogon

    Userinit.exe is launched by winlogon.exe and runs logon scripts for the user, reestablishes network connections, and then starts Explorer.exe. It also specifies programs Winlogon should run when a user logs on. Typically contains 'userinit.exe,'.

References

2 links

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)