Windows Terminal Profile

Location:

%LOCALAPPDATA%\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\LocalState\settings.json

Classification:

Criteria	Value
Permissions	User
Security context	User
Persistence type	File
Code type	EXE
Launch type	User initiated1
Impact	Non-destructive
OS Version	All OS versions
Dependencies	Additional software required2
Toolset	Scriptable

Description:

1. Modify the settings.json located in %localappdata% and add a custom profile that contains your payload
2. Change the defaultProfile value and put your GUID
3. Add the value "startOnUserLogin": true

References:

• https://twitter.com/nas_bench/status/1550836225652686848
• https://nasbench.medium.com/persistence-using-windows-terminal-profiles-5035d3fc86fe

Credits:

@nas_bench

See also:

Remarks:

1. Windows Terminal must be run ↩

2. Windows Terminal required ↩