Detect Network Logon Script in Google Chronicle
Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence. Network logon scripts can be assigned using Active Directory or Group Policy Objects. These logon scripts run with the privileges of the user they are assigned to. Depending on the systems within the network, initializing one of these scripts could apply to more than one or potentially all systems. Adversaries may use these scripts to maintain persistence on a network. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
MITRE ATT&CK
- Tactic
- Persistence Privilege Escalation
- Sub-technique
- T1037.003 Network Logon Script
- Canonical reference
- https://attack.mitre.org/techniques/T1037/003/
YARA-L Detection Query
rule t1037_003_network_logon_script {
meta:
author = "Argus Detection Engineering"
description = "Detects T1037.003 Network Logon Script persistence via script file creation in NETLOGON/SYSVOL, suspicious interpreter processes spawned at logon, and registry modifications to logon script keys."
mitre_attack_tactic = "Persistence"
mitre_attack_technique = "T1037.003"
mitre_attack_url = "https://attack.mitre.org/techniques/T1037/003/"
severity = "HIGH"
confidence = "HIGH"
reference = "https://attack.mitre.org/techniques/T1037/003/"
version = "1.0"
created = "2026-04-16"
events:
// Detection variant A: Script file creation in NETLOGON/SYSVOL
(
$e1.metadata.event_type = "FILE_CREATION"
and (
re.regex($e1.target.file.full_path, `(?i)\\(NETLOGON|SYSVOL|scripts)\\`) nocase
)
and (
re.regex($e1.target.file.full_path, `(?i)\.(bat|cmd|ps1|vbs|js|wsf|hta)$`) nocase
)
)
or
// Detection variant B: Suspicious process spawned from logon script host referencing NETLOGON/SYSVOL
(
$e1.metadata.event_type = "PROCESS_LAUNCH"
and (
re.regex($e1.principal.process.file.full_path, `(?i)\\(userinit|explorer)\.exe$`) nocase
)
and (
re.regex($e1.target.process.file.full_path, `(?i)\\(cmd|powershell|pwsh|wscript|cscript|mshta|regsvr32|rundll32)\.exe$`) nocase
)
and (
re.regex($e1.target.process.command_line, `(?i)(NETLOGON|SYSVOL|\\scripts\\)`) nocase
or re.regex($e1.principal.process.command_line, `(?i)(NETLOGON|SYSVOL|\\scripts\\)`) nocase
)
)
or
// Detection variant C: Logon script registry key modified
(
$e1.metadata.event_type = "REGISTRY_MODIFICATION"
and (
re.regex($e1.target.registry.registry_key, `(?i)SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon`) nocase
or re.regex($e1.target.registry.registry_key, `(?i)SOFTWARE\\Policies\\Microsoft\\Windows\\System`) nocase
or re.regex($e1.target.registry.registry_key, `(?i)\\Environment`) nocase
)
and (
re.regex($e1.target.registry.registry_value_name, `(?i)(UserInitMprLogonScript|Userinit|Scripts)`) nocase
)
)
or
// Detection variant D: AD scriptPath attribute modification (via Windows Security Event 5136)
(
$e1.metadata.event_type = "USER_CHANGE"
and $e1.metadata.product_event_type = "5136"
and re.regex($e1.additional.fields["AttributeLDAPDisplayName"], `(?i)scriptPath`) nocase
)
condition:
$e1
}YARA-L 2.0 rule detecting T1037.003 Network Logon Script persistence through four UDM event patterns: FILE_CREATION events in NETLOGON/SYSVOL paths with script extensions, PROCESS_LAUNCH events where userinit.exe or explorer.exe spawns interpreter processes with command lines referencing NETLOGON or SYSVOL paths, REGISTRY_MODIFICATION events targeting Winlogon or Environment registry keys for UserInitMprLogonScript or Userinit values, and USER_CHANGE events (Windows Security Event 5136) capturing Active Directory scriptPath attribute modifications. The rule uses YARA-L's nocase regex matching for robust coverage.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate domain administrators modifying user scriptPath attributes via Active Directory Users and Computers or PowerShell AD cmdlets during user provisioning.
- Group Policy management operations that update scripts in NETLOGON/SYSVOL shares as part of routine policy deployment or refresh, generating FILE_CREATION events on domain controllers.
- Enterprise endpoint management software (SCCM, Intune) modifying Winlogon registry keys during agent installation or configuration pushes.
- SYSVOL DFS replication that propagates legitimate script updates to replica domain controllers, creating FILE_CREATION UDM events across multiple hosts simultaneously.
Other platforms for T1037.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Set AD User ScriptPath Attribute via PowerShell
Expected signal: Security Event ID 5136 on Domain Controller: Directory Service Object Modification with AttributeLDAPDisplayName=scriptPath and the new AttributeValue. AuditLogs (Azure AD) OperationName='Update user' with modifiedProperties containing scriptPath. PowerShell ScriptBlock Log Event ID 4104 with Set-ADUser command.
- Test 2Create Malicious Script in NETLOGON Share
Expected signal: Sysmon Event ID 11 (File Create) on the domain controller: TargetFilename containing \NETLOGON\test_logon_script.bat, Image=powershell.exe. Security Event ID 4663 (if file auditing enabled on NETLOGON share): Object Access with ObjectName=\NETLOGON\test_logon_script.bat.
- Test 3Set UserInitMprLogonScript Registry Value for Persistence
Expected signal: Sysmon Event ID 13 (Registry Value Set): TargetObject=HKCU\Environment\UserInitMprLogonScript, Details=C:\Windows\Temp\test_logon.bat, Image=powershell.exe. Sysmon Event ID 11 (File Create) for the test_logon.bat script file creation. On next logon: Sysmon Event ID 1 process creation for cmd.exe executing the .bat file via userinit.exe.
- Test 4Simulate Logon Script Execution via userinit.exe Command Chain
Expected signal: Sysmon Event ID 1 (Process Create): Image=cmd.exe, CommandLine containing NETLOGON path reference, ParentImage=powershell.exe (or cmd.exe in nested execution). Security Event ID 4688 (if command line auditing enabled): NewProcessName=cmd.exe with CommandLine containing NETLOGON. Sysmon Event ID 11: file creation for test output files.
References (8)
- https://attack.mitre.org/techniques/T1037/003/
- https://www.petri.com/setting-up-logon-script-through-active-directory-users-computers-windows-server-2008
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn789190(v=ws.11)
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1037.003/T1037.003.md
- https://adsecurity.org/?p=2716
- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=5136
- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/active-directory-replication-status-tool
Unlock Pro Content
Get the full detection package for T1037.003 including response playbook, investigation guide, and atomic red team tests.