T1037.003sub-technique of T1037 Boot or Logon Initialization Scripts
Network Logon Script
Windowsnothing on this site yetT1037.003 on attack.mitre.org
Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence. Network logon scripts can be assigned using Active Directory or Group Policy Objects. These logon scripts run with the privileges of the user they are assigned to. Depending on the systems within the network, initializing one of these scripts could apply to more than one or potentially all systems.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
how MITRE says to see it
Detect Network Logon Script Abuse via Multi-Event Correlation on Windows
- Correlates Group Policy updates that configure network logon scripts with subsequent remote file execution behaviors triggered by user logons to identify potential persistence or execution chains tied to adversarial manipulation of logon scripts.
what reduces it
- M1022 Restrict File and Directory Permissions. Restrict write access to logon scripts to specific administrators.