> For the complete documentation index, see [llms.txt](https://dmcxblue.gitbook.io/red-team-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dmcxblue.gitbook.io/red-team-notes/persistence/logon-scripts.md). # Logon Scripts ## **Windows** Windows allows logon scripts to be run whenever a specific user or group of users log into a system. The Scripts can be used to perform administrative funtions, which may often execute other programs or send information to an internal logging server. If adversaries can access these scripts, they may insert additional code into the logon script to execute their tools when a suer logs in. This code can allow them to maintain persistence on a single system, if it is a local script, or to move laterally within a network, if the script is stored on a central server and pushed to many systems. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. ### Mac Mac allows login and logoff hooks to be run as root whenever a specific user logs into or out of a system. A login hook tell Mac OS X to execute a certain script when a user logs in, but unlike startup items, a login hook executes as root. There can only be one login hook at a time though. If adversaries can access these scripts, they can insert additional code to the script to execute their tools when a user logs in. In this example we will use a Windows 10 Machine, something easy I will create a bat file that will run and execute the Calculator every time the user logs in. ![](/files/-LxmPxZIObZFuoPX8wR3) I will use the following command on the command prompt and the bat file's content will be this: These require to have elevated permissions such as `root or admin` ``` schtasks /create /sc onlogon /tn "task-name" /tr "File or App PATH" /RU "username" ``` Attack executed: ![](/files/-LxmSPHIvnzvYF2wBBTE) With this logon script we can do much more such as capture an Empire stager, Enumerate, Dump credentials, and create a persistence that will call back to us every time a specific user log's in more examples can be done. We can modify Registry Keys that also act upon logon. More examples can be found here: {% embed url="" %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://dmcxblue.gitbook.io/red-team-notes/persistence/logon-scripts.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.