T1037.003: Network Logon Script
Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence. Network logon scripts can be assigned using Active Directory or Group Policy Objects. These logon scripts run with the privileges of the user they are assigned to. Depending on the systems within the network, initializing one of these scripts could apply to more than one or potentially all systems.
Adversaries may use these scripts to maintain persistence on a network. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
Detection
ID | DS0026 | Data source and component | Active Directory: Active Directory Object Modification | Description | Monitor for changes made in the Active Directory that may use network logon scripts automatically executed at logon initialization to establish persistence. |
---|
ID | DS0009 | Data source and component | Process: Process Creation | Description | Monitor for newly constructed processes and/or command-lines that execute logon scripts |
---|
ID | DS0017 | Data source and component | Command: Command Execution | Description | Monitor executed commands and arguments for logon scripts |
---|
ID | DS0022 | Data source and component | File: File Modification | Description | Monitor for changes made to files for unexpected modifications to unusual accounts outside of normal administration duties |
---|
ID | DS0022 | Data source and component | File: File Creation | Description | Monitor for newly constructed files by unusual accounts outside of normal administration duties |
---|
Mitigation
ID | M1022 | Name | Restrict File and Directory Permissions | Description | Restrict write access to logon scripts to specific administrators. |
---|