Which SIEM platforms have a T1037.003 detection rule?

df00tech provides T1037.003 (Network Logon Script) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Network Logon Script (T1037.003)?

Detecting Network Logon Script requires the following data sources: Active Directory: Active Directory Object Modification, File: File Creation, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Modification.

What severity and confidence is the T1037.003 detection?

The T1037.003 detection is rated high severity with medium confidence.

What are common false positives for T1037.003?

Common false positives for T1037.003 include: IT administrators legitimately deploying or updating logon scripts via Group Policy or AD Users and Computers for software deployment or environment configuration; SCCM/Intune or other endpoint management platforms that modify SYSVOL/NETLOGON share contents as part of normal GPO operations; Automated provisioning systems that set the scriptPath attribute on new user accounts during onboarding workflows.

T1037.003 IBM QRadar · QRadar

Detect Network Logon Script in IBM QRadar

Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence. Network logon scripts can be assigned using Active Directory or Group Policy Objects. These logon scripts run with the privileges of the user they are assigned to. Depending on the systems within the network, initializing one of these scripts could apply to more than one or potentially all systems. Adversaries may use these scripts to maintain persistence on a network. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.

MITRE ATT&CK

Tactic: Persistence Privilege Escalation
Technique: T1037 Boot or Logon Initialization Scripts
Sub-technique: T1037.003 Network Logon Script
Canonical reference: https://attack.mitre.org/techniques/T1037/003/

QRadar Detection Query

IBM QRadar (QRadar)

sql

-- Detection 1: Script file created/modified in NETLOGON/SYSVOL (Sysmon Event 11)
SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  "sourceip" AS host_ip,
  username,
  QIDNAME(qid) AS event_name,
  "TargetFilename" AS target_file,
  "Image" AS initiating_image,
  'Script File in NETLOGON/SYSVOL' AS detection_type
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) = 12 -- Windows
  AND QIDNAME(qid) LIKE '%Sysmon%'
  AND LONG("EventID") = 11
  AND (
    "TargetFilename" ILIKE '%\NETLOGON\%'
    OR "TargetFilename" ILIKE '%\SYSVOL\%'
    OR "TargetFilename" ILIKE '%\scripts\%'
  )
  AND (
    "TargetFilename" ILIKE '%.bat'
    OR "TargetFilename" ILIKE '%.cmd'
    OR "TargetFilename" ILIKE '%.ps1'
    OR "TargetFilename" ILIKE '%.vbs'
    OR "TargetFilename" ILIKE '%.js'
    OR "TargetFilename" ILIKE '%.wsf'
    OR "TargetFilename" ILIKE '%.hta'
  )
  AND devicetime > NOW() - 86400000
UNION ALL
-- Detection 2: Suspicious process spawned from logon script path (Sysmon Event 1)
SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  "sourceip" AS host_ip,
  username,
  QIDNAME(qid) AS event_name,
  "CommandLine" AS target_file,
  "Image" AS initiating_image,
  'Suspicious Logon Script Process Execution' AS detection_type
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) = 12
  AND QIDNAME(qid) LIKE '%Sysmon%'
  AND LONG("EventID") = 1
  AND (
    "ParentImage" ILIKE '%\userinit.exe'
    OR "ParentImage" ILIKE '%\explorer.exe'
  )
  AND (
    "Image" ILIKE '%\cmd.exe'
    OR "Image" ILIKE '%\powershell.exe'
    OR "Image" ILIKE '%\wscript.exe'
    OR "Image" ILIKE '%\cscript.exe'
    OR "Image" ILIKE '%\mshta.exe'
    OR "Image" ILIKE '%\rundll32.exe'
    OR "Image" ILIKE '%\regsvr32.exe'
  )
  AND (
    "CommandLine" ILIKE '%NETLOGON%'
    OR "CommandLine" ILIKE '%SYSVOL%'
    OR "CommandLine" ILIKE '%\scripts\%'
    OR "ParentCommandLine" ILIKE '%NETLOGON%'
    OR "ParentCommandLine" ILIKE '%SYSVOL%'
  )
  AND devicetime > NOW() - 86400000
UNION ALL
-- Detection 3: Logon script registry key modified (Sysmon Event 13)
SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  "sourceip" AS host_ip,
  username,
  QIDNAME(qid) AS event_name,
  "TargetObject" AS target_file,
  "Image" AS initiating_image,
  'Logon Script Registry Key Modified' AS detection_type
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) = 12
  AND QIDNAME(qid) LIKE '%Sysmon%'
  AND LONG("EventID") = 13
  AND (
    "TargetObject" ILIKE '%\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon%'
    OR "TargetObject" ILIKE '%\SOFTWARE\Policies\Microsoft\Windows\System%'
    OR "TargetObject" ILIKE '%\Environment%'
  )
  AND (
    "TargetObject" ILIKE '%UserInitMprLogonScript%'
    OR "TargetObject" ILIKE '%Userinit%'
  )
  AND devicetime > NOW() - 86400000
UNION ALL
-- Detection 4: AD scriptPath attribute modified (Security Event 5136)
SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  "sourceip" AS host_ip,
  username,
  QIDNAME(qid) AS event_name,
  "ObjectDN" AS target_file,
  "SubjectUserName" AS initiating_image,
  'AD scriptPath Attribute Modified' AS detection_type
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) = 12
  AND LONG("EventID") = 5136
  AND "AttributeLDAPDisplayName" = 'scriptPath'
  AND devicetime > NOW() - 86400000
ORDER BY event_time DESC

high severity high confidence

Detects T1037.003 Network Logon Script persistence using four AQL queries unioned together: (1) Sysmon Event 11 for script file creation in NETLOGON/SYSVOL, (2) Sysmon Event 1 for suspicious interpreter processes launched from logon script paths via userinit/explorer, (3) Sysmon Event 13 for registry modifications to Winlogon or Environment keys related to logon scripts, and (4) Windows Security Event 5136 for Active Directory scriptPath attribute modifications on user objects.

Data Sources

Microsoft Windows Security Event Log (EventID 5136)Sysmon Operational Log (EventID 1, 11, 13) via Windows Log SourceQRadar Windows Log Source Type (LOGSOURCETYPEID 12)

Required Tables

events

False Positives & Tuning

Domain administrators legitimately modifying the scriptPath attribute of user objects in Active Directory during onboarding, offboarding, or Group Policy refresh cycles.
IT automation systems (SCCM, Intune, or custom deployment scripts) that create or update login scripts in NETLOGON or SYSVOL as part of routine software distribution.
Security tools or endpoint agents that modify Winlogon registry keys during installation or updates, triggering Sysmon Event 13 on the registry path.
DC replication of legitimate SYSVOL content creating Sysmon file events on replica domain controllers.

Download portable Sigma rule (.yml)

Other platforms for T1037.003

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Set AD User ScriptPath Attribute via PowerShell
Expected signal: Security Event ID 5136 on Domain Controller: Directory Service Object Modification with AttributeLDAPDisplayName=scriptPath and the new AttributeValue. AuditLogs (Azure AD) OperationName='Update user' with modifiedProperties containing scriptPath. PowerShell ScriptBlock Log Event ID 4104 with Set-ADUser command.
Test 2Create Malicious Script in NETLOGON Share
Expected signal: Sysmon Event ID 11 (File Create) on the domain controller: TargetFilename containing \NETLOGON\test_logon_script.bat, Image=powershell.exe. Security Event ID 4663 (if file auditing enabled on NETLOGON share): Object Access with ObjectName=\NETLOGON\test_logon_script.bat.
Test 3Set UserInitMprLogonScript Registry Value for Persistence
Expected signal: Sysmon Event ID 13 (Registry Value Set): TargetObject=HKCU\Environment\UserInitMprLogonScript, Details=C:\Windows\Temp\test_logon.bat, Image=powershell.exe. Sysmon Event ID 11 (File Create) for the test_logon.bat script file creation. On next logon: Sysmon Event ID 1 process creation for cmd.exe executing the .bat file via userinit.exe.
Test 4Simulate Logon Script Execution via userinit.exe Command Chain
Expected signal: Sysmon Event ID 1 (Process Create): Image=cmd.exe, CommandLine containing NETLOGON path reference, ParentImage=powershell.exe (or cmd.exe in nested execution). Security Event ID 4688 (if command line auditing enabled): NewProcessName=cmd.exe with CommandLine containing NETLOGON. Sysmon Event ID 11: file creation for test output files.

Last updated: 2026-04-16 Research depth: deep

References (8)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1037.003 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Network Logon Script in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1037.003

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Persistence

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1037.003

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Persistence

Popular Detections

Get new detections in your inbox