Techniques › T1037.001 › AN0199
AN0199 Analytic 0199
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects adversary use of logon script configuration via Group Policy or user object attributes, followed by script execution post-authentication. Behavior includes modification of script path or file, then process execution under user logon context.</p>
- Detects
- T1037.001 Logon Script (Windows)
- Part of
- DET0072 Detect Logon Script Modifications and Execution
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4663, 4670, 4656 | DC0055 File Access |
| WinEventLog:System | EventCode=1502, 1503 | DC0029 Script Execution |
| WinEventLog:Security | EventCode=4624, 4648 | DC0067 Logon Session Creation |
| WinEventLog:Security | EventCode=4688 | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
script_path_keywords | Defenders may tune for known script locations such as NETLOGON, SYSVOL, or \domain\sysvol\*.bat/.ps1 |
execution_time_window | May be scoped to user logon hours or first X minutes post-authentication |
user_context | Organizations may focus on specific users/groups with high privilege or remote access |