Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence. Network logon scripts can be assigned using Active Directory or Group Policy Objects.(Citation: Petri Logon Script AD) These logon scripts run with the privileges of the user they are assigned to. Depending on the systems within the network, initializing one of these scripts could apply to more than one or potentially all systems.
Adversaries may use these scripts to maintain persistence on a network. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CA-07 | Continuous Monitoring | mitigates | T1037.003 | Network Logon Script | |
| CM-06 | Configuration Settings | mitigates | T1037.003 | Network Logon Script | |
| SI-03 | Malicious Code Protection | mitigates | T1037.003 | Network Logon Script | |
| SI-07 | Software, Firmware, and Information Integrity | mitigates | T1037.003 | Network Logon Script | |
| CM-02 | Baseline Configuration | mitigates | T1037.003 | Network Logon Script | |
| SI-04 | System Monitoring | mitigates | T1037.003 | Network Logon Script | |
| AC-03 | Access Enforcement | mitigates | T1037.003 | Network Logon Script |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| attribute.integrity.variety.Modify configuration | Modified configuration or services | related-to | T1037.003 | Network Logon Script |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| google_secops | Google Security Operations | technique_scores | T1037.003 | Network Logon Script |
Comments
Google Security Ops triggers an alert based on suspicious connections (e.g., Netlogon connections).
https://github.com/chronicle/detection-rules/blob/783e0e5947774785db1c55041b70176deeca6f46/soc_prime_rules/proactive_exploit_detection/system/vulnerable_netlogon_secure_channel_connection_allowed.yaral
https://github.com/chronicle/detection-rules/blob/783e0e5947774785db1c55041b70176deeca6f46/soc_prime_rules/threat_hunting/sysmon/logon_scripts__userinitmprlogonscript.yaral
References
|