Boot or Logon Initialization Scripts: Network Logon Script (T1037.003)

Tactics: Persistence, Privilege Escalation · Platforms: Windows

The interactive view maps 1 detection strategy, 1 mitigation to this technique, alongside D3FEND countermeasures and data-component coverage.

Sub-technique of Boot or Logon Initialization Scripts (T1037).

Overview

Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence. Network logon scripts can be assigned using Active Directory or Group Policy Objects. These logon scripts run with the privileges of the user they are assigned to. Depending on the systems within the network, initializing one of these scripts could apply to more than one or potentially all systems. Adversaries may use these scripts to maintain persistence on a network. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.

Explore

• Open T1037.003 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1037.003
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan