T1037.003 — Network Logon Script

Tactics: Persistence, Privilege Escalation · Platforms: Windows

Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence. Network logon scripts can be assigned using Active Directory or Group Policy Objects. These logon scripts run with the privileges of the user they are assigned to. Depending on the…

Sub-technique of Boot or Logon Initialization Scripts (T1037).

Sigma detection rules (1)

T1037.003 Boot or Logon Initialization Scripts: Network Logon Script

title: "T1037.003 Boot or Logon Initialization Scripts: Network Logon Script"
id: e6c7e552-5b4a-4000-9d63-e8ffa9b8cc6b
description: 'Detects Detailed File Share access to SYSVOL/NETLOGON shares targeting logon-script file types (.bat/.cmd/.vbs/.vbe/.js/.ps1), a proxy for network logon script creation/tampering for persistence. (Data Component: Network Share Access; baseline tier: windows-eventid.) Tune using: TargetObject, ParentProcessName, TimeWindow, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1037/003
author: Shahrukh Khan
date: 2026-04-05
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1037.003

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID: '5145'
    ShareName|contains:
      - 'SYSVOL'
      - 'NETLOGON'
  selection_script_ext:
    RelativeTargetName|endswith:
      - '.bat'
      - '.cmd'
      - '.vbs'
      - '.vbe'
      - '.js'
      - '.ps1'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and selection_script_ext and not filter_system_account

falsepositives:
  - Legitimate logon-script deployment or edits by domain administrators or GPO management tooling; System and service accounts are excluded via filter_system_account; tune further with admin-workstation allowlists if noise remains.

level: medium

Related sub-techniques

Explore