Матрица MITRE ATT&CK

PT Sandbox

Profound defense against sophisticated malware and zero-day threats

Technique on mitre.org

T1037.003: Network Logon Script

Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence. Network logon scripts can be assigned using Active Directory or Group Policy Objects. These logon scripts run with the privileges of the user they are assigned to. Depending on the systems within the network, initializing one of these scripts could apply to more than one or potentially all systems.

Adversaries may use these scripts to maintain persistence on a network. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.

Positive Technologies products that cover the technique

Description of detection methods is not available yet

Detection

ID	DS0017	Data source and component	Command: Command Execution	Description	Monitor executed commands and arguments for logon scripts

ID	DS0026	Data source and component	Active Directory: Active Directory Object Modification	Description	Monitor for changes made in the Active Directory that may use network logon scripts automatically executed at logon initialization to establish persistence.

ID	DS0022	Data source and component	File: File Modification	Description	Monitor for changes made to files for unexpected modifications to unusual accounts outside of normal administration duties

ID	DS0009	Data source and component	Process: Process Creation	Description	Monitor for newly constructed processes and/or command-lines that execute logon scripts

ID	DS0022	Data source and component	File: File Creation	Description	Monitor for newly constructed files by unusual accounts outside of normal administration duties

ID	Data source and component	Description
DS0017	Command: Command Execution	Monitor executed commands and arguments for logon scripts
DS0026	Active Directory: Active Directory Object Modification	Monitor for changes made in the Active Directory that may use network logon scripts automatically executed at logon initialization to establish persistence.
DS0022	File: File Modification	Monitor for changes made to files for unexpected modifications to unusual accounts outside of normal administration duties
DS0009	Process: Process Creation	Monitor for newly constructed processes and/or command-lines that execute logon scripts
DS0022	File: File Creation	Monitor for newly constructed files by unusual accounts outside of normal administration duties

Mitigation

ID	M1022	Name	Restrict File and Directory Permissions	Description	Restrict write access to logon scripts to specific administrators.

ID	Name	Description
M1022	Restrict File and Directory Permissions	Restrict write access to logon scripts to specific administrators.