Detect Network Logon Script in Elastic Security
Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence. Network logon scripts can be assigned using Active Directory or Group Policy Objects. These logon scripts run with the privileges of the user they are assigned to. Depending on the systems within the network, initializing one of these scripts could apply to more than one or potentially all systems. Adversaries may use these scripts to maintain persistence on a network. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
MITRE ATT&CK
- Tactic
- Persistence Privilege Escalation
- Sub-technique
- T1037.003 Network Logon Script
- Canonical reference
- https://attack.mitre.org/techniques/T1037/003/
Elastic Detection Query
sequence by host.name with maxspan=5m
[
// Detection 1: Script file created/modified in NETLOGON/SYSVOL paths
file where event.type in ("creation", "change") and
(
file.path : ("*\\NETLOGON\\*", "*\\SYSVOL\\*", "*\\scripts\\*") and
file.extension : ("bat", "cmd", "ps1", "vbs", "js", "wsf", "hta")
)
]
or
// Detection 2: Suspicious process spawned from logon script host at logon
sequence by host.name with maxspan=2m
[
process where event.type == "start" and
process.parent.name : ("userinit.exe", "explorer.exe") and
process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "regsvr32.exe", "rundll32.exe") and
(
process.command_line : ("*NETLOGON*", "*SYSVOL*", "*\\scripts\\*") or
process.parent.command_line : ("*NETLOGON*", "*SYSVOL*", "*\\scripts\\*")
)
]
or
// Detection 3: Logon script registry key modified
registry where event.type in ("creation", "change") and
(
registry.path : (
"*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*",
"*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System*",
"*\\Environment*"
) and
registry.value : ("UserInitMprLogonScript", "Userinit", "Scripts")
)Detects T1037.003 Network Logon Script persistence via three detection approaches: (1) script files created/modified in NETLOGON, SYSVOL, or scripts share paths with suspicious extensions, (2) suspicious interpreter processes (cmd, PowerShell, wscript, etc.) launched by userinit.exe or explorer.exe referencing logon script paths, and (3) registry key modifications targeting Winlogon or Environment keys used to set logon scripts (UserInitMprLogonScript, Userinit). Covers both file-system and registry-based persistence mechanisms.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate IT administrators deploying or updating login scripts in NETLOGON/SYSVOL share as part of scheduled Group Policy maintenance or system provisioning workflows.
- Software deployment tools (SCCM, Ansible, Puppet) that write scripts to SYSVOL or NETLOGON as part of automated provisioning or configuration management.
- Security or compliance tooling that modifies Winlogon registry keys (e.g., Userinit) during installation or updates, such as endpoint detection agents or VPN clients.
- Domain controller replication processes that propagate legitimate SYSVOL script changes across domain controllers, generating file creation events on replica DCs.
Other platforms for T1037.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Set AD User ScriptPath Attribute via PowerShell
Expected signal: Security Event ID 5136 on Domain Controller: Directory Service Object Modification with AttributeLDAPDisplayName=scriptPath and the new AttributeValue. AuditLogs (Azure AD) OperationName='Update user' with modifiedProperties containing scriptPath. PowerShell ScriptBlock Log Event ID 4104 with Set-ADUser command.
- Test 2Create Malicious Script in NETLOGON Share
Expected signal: Sysmon Event ID 11 (File Create) on the domain controller: TargetFilename containing \NETLOGON\test_logon_script.bat, Image=powershell.exe. Security Event ID 4663 (if file auditing enabled on NETLOGON share): Object Access with ObjectName=\NETLOGON\test_logon_script.bat.
- Test 3Set UserInitMprLogonScript Registry Value for Persistence
Expected signal: Sysmon Event ID 13 (Registry Value Set): TargetObject=HKCU\Environment\UserInitMprLogonScript, Details=C:\Windows\Temp\test_logon.bat, Image=powershell.exe. Sysmon Event ID 11 (File Create) for the test_logon.bat script file creation. On next logon: Sysmon Event ID 1 process creation for cmd.exe executing the .bat file via userinit.exe.
- Test 4Simulate Logon Script Execution via userinit.exe Command Chain
Expected signal: Sysmon Event ID 1 (Process Create): Image=cmd.exe, CommandLine containing NETLOGON path reference, ParentImage=powershell.exe (or cmd.exe in nested execution). Security Event ID 4688 (if command line auditing enabled): NewProcessName=cmd.exe with CommandLine containing NETLOGON. Sysmon Event ID 11: file creation for test output files.
References (8)
- https://attack.mitre.org/techniques/T1037/003/
- https://www.petri.com/setting-up-logon-script-through-active-directory-users-computers-windows-server-2008
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn789190(v=ws.11)
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1037.003/T1037.003.md
- https://adsecurity.org/?p=2716
- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=5136
- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/active-directory-replication-status-tool
Unlock Pro Content
Get the full detection package for T1037.003 including response playbook, investigation guide, and atomic red team tests.