Detect Network Logon Script in CrowdStrike LogScale
Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence. Network logon scripts can be assigned using Active Directory or Group Policy Objects. These logon scripts run with the privileges of the user they are assigned to. Depending on the systems within the network, initializing one of these scripts could apply to more than one or potentially all systems. Adversaries may use these scripts to maintain persistence on a network. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
MITRE ATT&CK
- Tactic
- Persistence Privilege Escalation
- Sub-technique
- T1037.003 Network Logon Script
- Canonical reference
- https://attack.mitre.org/techniques/T1037/003/
LogScale Detection Query
// Detection 1: Script file created/written in NETLOGON/SYSVOL paths
#event_simpleName = "PeFileWritten" OR #event_simpleName = "NewExecutableWritten"
| TargetFilename = /(?i)\\(NETLOGON|SYSVOL|scripts)\\/
| TargetFilename = /(?i)\.(bat|cmd|ps1|vbs|js|wsf|hta)$/
| "Script File in NETLOGON/SYSVOL" as DetectionType
| table([_timereceived, ComputerName, UserName, TargetFilename, FilePath, SHA256HashData, DetectionType])
// Detection 2: Suspicious interpreter spawned by userinit/explorer with logon script path references
// Run as separate query
#event_simpleName = "ProcessRollup2"
| ParentBaseFileName = /(?i)^(userinit|explorer)\.exe$/
| ImageFileName = /(?i)\\(cmd|powershell|pwsh|wscript|cscript|mshta|regsvr32|rundll32)\.exe$/
| CommandLine = /(?i)(NETLOGON|SYSVOL|\\scripts\\)/
OR ParentCommandLine = /(?i)(NETLOGON|SYSVOL|\\scripts\\)/
| "Suspicious Logon Script Interpreter Process" as DetectionType
| table([_timereceived, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, ParentCommandLine, TargetProcessId, DetectionType])
// Detection 3: Registry modifications to logon script keys
#event_simpleName = "RegValueUpdate" OR #event_simpleName = "RegValueCreate"
| TargetObject = /(?i)SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon/
OR TargetObject = /(?i)SOFTWARE\\Policies\\Microsoft\\Windows\\System/
OR TargetObject = /(?i)\\Environment/
| TargetObject = /(?i)(UserInitMprLogonScript|Userinit|Scripts)/
| "Logon Script Registry Key Modified" as DetectionType
| table([_timereceived, ComputerName, UserName, TargetObject, RegStringValue, ImageFileName, CommandLine, DetectionType])
// Aggregate summary across all detection types (combine above with union pattern)
// Full unified hunting query:
(
(
#event_simpleName = "PeFileWritten" OR #event_simpleName = "NewExecutableWritten"
| TargetFilename = /(?i)\\(NETLOGON|SYSVOL|scripts)\\/
| TargetFilename = /(?i)\.(bat|cmd|ps1|vbs|js|wsf|hta)$/
| "Script File in NETLOGON/SYSVOL" as DetectionType
| rename(TargetFilename, as=Indicator)
)
union
(
#event_simpleName = "ProcessRollup2"
| ParentBaseFileName = /(?i)^(userinit|explorer)\.exe$/
| ImageFileName = /(?i)\\(cmd|powershell|pwsh|wscript|cscript|mshta|regsvr32|rundll32)\.exe$/
| CommandLine = /(?i)(NETLOGON|SYSVOL|\\scripts\\)/
| "Suspicious Logon Script Interpreter" as DetectionType
| rename(CommandLine, as=Indicator)
)
union
(
#event_simpleName = /^(RegValueUpdate|RegValueCreate)$/
| TargetObject = /(?i)(Winlogon|Environment|Windows\\System)/
| TargetObject = /(?i)(UserInitMprLogonScript|Userinit)/
| "Logon Script Registry Modified" as DetectionType
| rename(TargetObject, as=Indicator)
)
)
| groupBy([ComputerName, UserName, DetectionType], function=count(as=EventCount))
| sort(EventCount, order=desc)CrowdStrike LogScale (Falcon) detection for T1037.003 Network Logon Script persistence using three Falcon event types: (1) PeFileWritten/NewExecutableWritten for script file drops in NETLOGON/SYSVOL/scripts paths, (2) ProcessRollup2 for suspicious interpreter processes (cmd, PowerShell, wscript, etc.) spawned by userinit.exe or explorer.exe with command lines referencing logon script share paths, and (3) RegValueUpdate/RegValueCreate targeting Winlogon or Environment registry keys for UserInitMprLogonScript or Userinit values. Includes a unified hunting query with groupBy aggregation to surface hosts with multiple detection events.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Group Policy or domain administration workflows where IT staff deploy updated login scripts to NETLOGON/SYSVOL, triggering PeFileWritten events on domain controllers.
- Software installers or endpoint management agents (e.g., CrowdStrike Falcon sensor updates, SCCM client) that modify Winlogon registry keys during installation, generating RegValueUpdate events.
- PowerShell-based management scripts legitimately launched by IT tooling through userinit.exe or explorer.exe at session initialization that happen to reference SYSVOL paths for configuration loading.
- SYSVOL DFS-R replication processes propagating legitimate administrator-sanctioned script changes to all domain controllers in the forest.
Other platforms for T1037.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Set AD User ScriptPath Attribute via PowerShell
Expected signal: Security Event ID 5136 on Domain Controller: Directory Service Object Modification with AttributeLDAPDisplayName=scriptPath and the new AttributeValue. AuditLogs (Azure AD) OperationName='Update user' with modifiedProperties containing scriptPath. PowerShell ScriptBlock Log Event ID 4104 with Set-ADUser command.
- Test 2Create Malicious Script in NETLOGON Share
Expected signal: Sysmon Event ID 11 (File Create) on the domain controller: TargetFilename containing \NETLOGON\test_logon_script.bat, Image=powershell.exe. Security Event ID 4663 (if file auditing enabled on NETLOGON share): Object Access with ObjectName=\NETLOGON\test_logon_script.bat.
- Test 3Set UserInitMprLogonScript Registry Value for Persistence
Expected signal: Sysmon Event ID 13 (Registry Value Set): TargetObject=HKCU\Environment\UserInitMprLogonScript, Details=C:\Windows\Temp\test_logon.bat, Image=powershell.exe. Sysmon Event ID 11 (File Create) for the test_logon.bat script file creation. On next logon: Sysmon Event ID 1 process creation for cmd.exe executing the .bat file via userinit.exe.
- Test 4Simulate Logon Script Execution via userinit.exe Command Chain
Expected signal: Sysmon Event ID 1 (Process Create): Image=cmd.exe, CommandLine containing NETLOGON path reference, ParentImage=powershell.exe (or cmd.exe in nested execution). Security Event ID 4688 (if command line auditing enabled): NewProcessName=cmd.exe with CommandLine containing NETLOGON. Sysmon Event ID 11: file creation for test output files.
References (8)
- https://attack.mitre.org/techniques/T1037/003/
- https://www.petri.com/setting-up-logon-script-through-active-directory-users-computers-windows-server-2008
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn789190(v=ws.11)
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1037.003/T1037.003.md
- https://adsecurity.org/?p=2716
- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=5136
- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/active-directory-replication-status-tool
Unlock Pro Content
Get the full detection package for T1037.003 including response playbook, investigation guide, and atomic red team tests.