Logon Scripts

Windows

Windows allows logon scripts to be run whenever a specific user or group of users log into a system. [1] The scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server.

If adversaries can access these scripts, they may insert additional code into the logon script to execute their tools when a user logs in. This code can allow them to maintain persistence on a single system, if it is a local script, or to move laterally within a network, if the script is stored on a central server and pushed to many systems. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.

Mac

Mac allows login and logoff hooks to be run as root whenever a specific user logs into or out of a system. A login hook tells Mac OS X to execute a certain script when a user logs in, but unlike startup items, a login hook executes as root [2]. There can only be one login hook at a time though. If adversaries can access these scripts, they can insert additional code to the script to execute their tools when a user logs in.

ID: T1037
Tactic: Lateral Movement, Persistence
Platform: macOS, Windows
System Requirements: Write access to system or domain logon scripts
Data Sources: File monitoring, Process monitoring
CAPEC ID: CAPEC-564
Version: 1.0

Procedure Examples

Name Description
APT28 An APT28 loader Trojan adds the Registry key HKCU\Environment\UserInitMprLogonScript to establish persistence. [6]
Cobalt Group Cobalt Group has added persistence by registering the file name for the next stage malware under UserInitMprLogonScript. [7]
JHUHUGIT JHUHUGIT has registered a Windows shell script under the Registry key HKCU\Environment\UserInitMprLogonScript to establish persistence. [3] [4]
Zebrocy Zebrocy performs persistence via adding a Registry key with a logon script. [5]

Mitigations

Mitigation Description
Restrict File and Directory Permissions Restrict write access to logon scripts to specific administrators.

Detection

Monitor logon scripts for unusual access by abnormal users or at abnormal times. Look for files added or modified by unusual accounts outside of normal administration duties.

References