ADSCRIPT-003: Inventario de scripts de inicio de sesión
- Plataforma
- Active Directory
- Categoría
- AD Logon Scripts & Network Shares
- Severidad
- Info
- Pilar de Zero Trust
- Applications & Workloads (peso 1)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Un inventario de todos los scripts de inicio de sesión a los que hacen referencia las cuentas de usuario (atributo scriptPath), los scripts de inicio/cierre de sesión de directiva de grupo y los scripts de arranque/apagado proporciona visibilidad de todo el código que se ejecuta automáticamente en el entorno. Los scripts que existen en NETLOGON pero que no están referenciados pueden estar huérfanos o ser indicadores de un compromiso pasado
Por qué importa
Logon and startup scripts are persistence and lateral-movement primitives. A script in NETLOGON that no administrator can account for is a high-confidence indicator of past compromise or unmanaged change. Conversely, a user whose scriptPath points to a file that is missing from NETLOGON is a sign of stale automation that an attacker can resurrect by simply dropping a file of that name into the share. Without a maintained inventory, defenders cannot answer the basic question "what code executes when each user logs on" and cannot reason about blast radius for any of the downstream ADSCRIPT checks. Logon scripts execute on every workstation a user authenticates to, so a single compromised script reaches the entire user population mapped to it. Startup and shutdown scripts execute as SYSTEM on every domain-joined computer in scope of the GPO, which is the maximum local privilege.
Ruta de ataque
1. Reconnaissance: an attacker with any authenticated foothold queries the directory with Get-ADUser -Filter {scriptPath -like "*"} or LDAP equivalent to enumerate every user with an assigned logon script. 2. Target selection: the attacker prioritizes scripts referenced by privileged users, IT staff, or large user populations. Helpdesk and service-desk OUs are common targets because they touch many endpoints. 3. Write-access probe: the attacker checks the ACL on each referenced script and on NETLOGON itself. Misconfigurations that grant Authenticated Users, Domain Users, or Everyone modify rights, or write access to a parent folder, are exploited directly. 4. Orphan resurrection: where scriptPath points to a missing file, the attacker drops a script of the same name into NETLOGON. The next logon of any user with that scriptPath value runs attacker code in that user context (MITRE T1037.003). 5. ScriptPath hijack: with WriteProperty on the target user (often via abusable ACLs surfaced by BloodHound), the attacker rewrites scriptPath to a script they control, achieving code execution as the victim on next logon. 6. SYSTEM escalation: if the same approach is taken against a GPO startup script (where the attacker has edit rights on the GPO or write rights on the SYSVOL path), code runs as SYSTEM on every targeted computer. 7. Persistence: the change blends into normal directory traffic and survives password resets, since execution depends on the script content rather than any credential.
Cómo lo evalúa Guerrilla
Guerrilla queries the directory for all user objects with a non-empty scriptPath, parses every GPO in the domain for User and Computer script extensions (CSEs {42B5FAAE-6536-11D2-AE5A-0000F87571E3} for scripts), and enumerates the file listing of the NETLOGON share. Each script reference is recorded with its source (User.scriptPath, GPO Logon, GPO Logoff, GPO Startup, GPO Shutdown), the principal it runs as, the resolved UNC path, and the file metadata (size, last write time, owner). The four sets are joined on filename and full path to produce the orphan, missing, and matched lists. No misconfiguration is asserted at this stage: the check is informational, and produces the dataset consumed by ADSCRIPT-001, ADSCRIPT-002, ADSCRIPT-004 and the rest of the category.
Valor recomendado
Inventario completo de todos los scripts de inicio de sesión con su propósito documentado, propietario y fecha de última modificación
Remediación
Enumere todos los atributos scriptPath de los usuarios con Get-ADUser -Filter {scriptPath -like '*'} -Properties scriptPath. Enumere todos los scripts configurados por GPO a partir de los informes de GPO. Inventaríe todos los archivos del recurso compartido NETLOGON. Realice una referencia cruzada para identificar scripts huérfanos, scripts sin uso y scripts referenciados por cuentas de usuario pero ausentes de NETLOGON. Documente el propósito y el propietario de cada script.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CM-8, CM-8(1), CM-3
- MITRE ATT&CK
- T1059