Logon Scripts
ID: T1037 Tactic: Lateral Movement, Persistence
Last updated
ID: T1037 Tactic: Lateral Movement, Persistence
Last updated
Windows allows logon scripts to be run whenever a specific user or group of users log into a system. The Scripts can be used to perform administrative funtions, which may often execute other programs or send information to an internal logging server.
If adversaries can access these scripts, they may insert additional code into the logon script to execute their tools when a suer logs in. This code can allow them to maintain persistence on a single system, if it is a local script, or to move laterally within a network, if the script is stored on a central server and pushed to many systems. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
Mac allows login and logoff hooks to be run as root whenever a specific user logs into or out of a system. A login hook tell Mac OS X to execute a certain script when a user logs in, but unlike startup items, a login hook executes as root. There can only be one login hook at a time though. If adversaries can access these scripts, they can insert additional code to the script to execute their tools when a user logs in.
In this example we will use a Windows 10 Machine, something easy I will create a bat file that will run and execute the Calculator every time the user logs in.
I will use the following command on the command prompt and the bat file's content will be this:
These require to have elevated permissions such as root or admin
Attack executed:
With this logon script we can do much more such as capture an Empire stager, Enumerate, Dump credentials, and create a persistence that will call back to us every time a specific user log's in more examples can be done. We can modify Registry Keys that also act upon logon.
More examples can be found here:
