Boot or Logon Initialization Scripts: Network Logon Script
- ID
- T1037.003
- Tactics
- TA0003 Persistence, TA0004 Privilege Escalation
- Sub-technique of
- T1037 Boot or Logon Initialization Scripts
- Platforms
- Windows
- Data sources
- Network Share Access, Process Creation, Script Execution
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence. Network logon scripts can be assigned using Active Directory or Group Policy Objects.[1] These logon scripts run with the privileges of the user they are assigned to. Depending on the systems within the network, initializing one of these scripts could apply to more than one or potentially all systems.
Adversaries may use these scripts to maintain persistence on a network. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
Detection
- DET0367 Detect Network Logon Script Abuse via Multi-Event Correlation on Windows
Data components: Network Share Access, Process Creation, Script Execution
Mitigations (1)
- M1022 Restrict File and Directory Permissions
Restrict write access to logon scripts to specific administrators.