MITRE ATT&CKsub-technique

T1037.003 Network Logon Script

Published 2020-01-10 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Persistence, Privilege Escalation
Platforms
Windows
Version
1.0
Created
2020-01-10

Description

Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence. Network logon scripts can be assigned using Active Directory or Group Policy Objects. These logon scripts run with the privileges of the user they are assigned to. Depending on the systems within the network, initializing one of these scripts could apply to more than one or potentially all systems. Adversaries may use these scripts to maintain persistence on a network. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1037 Boot or Logon Initialization Scripts technique

Tactic · MITRE ATT&CK (2)

  • TA0003 Persistence tactic
  • TA0004 Privilege Escalation tactic

Referenced by MITRE ATT&CK · mitigates (1)

  • M1022 Restrict File and Directory Permissions mitigation

Referenced by MITRE ATT&CK · uses (1)

  • S9051 The Gentlemen Ransomware software (malware)

Referenced by Compliance · mitigates (7)

  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References