ADSCRIPT-003: Logon Script Inventory
- Plataforma
- Active Directory
- Categoría
- AD Logon Scripts & Network Shares
- Severidad
- Info
- Pilar de Zero Trust
- Applications & Workloads (peso 1)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
The check enumerates four sources of automatically executed code and joins them into a single inventory. 1. User scriptPath attribute: Get-ADUser -Filter {scriptPath -like "*"} -Properties scriptPath. The scriptPath attribute is a single-valued Unicode string on the user object that names a script executed during interactive logon, resolved relative to the NETLOGON share of the authenticating domain controller. 2. Group Policy User Configuration logon and logoff scripts, stored under \\<domain>\SYSVOL\<domain>\Policies\{GUID}\User\Scripts\Logon and \Logoff, indexed by scripts.ini in the same folder. 3. Group Policy Computer Configuration startup and shutdown scripts, stored under \\<domain>\SYSVOL\<domain>\Policies\{GUID}\Machine\Scripts\Startup and \Shutdown. Startup and shutdown scripts execute as NT AUTHORITY\SYSTEM, not as the logged on user. 4. The file system contents of the NETLOGON share (\\<domain>\NETLOGON, which is SYSVOL\<domain>\scripts). The four sets are joined to produce: scripts referenced by a user but missing from NETLOGON (broken references), scripts present in NETLOGON but not referenced by any user or GPO (orphans), and scripts referenced by GPO whose backing file is absent from SYSVOL.
Por qué importa
Logon and startup scripts are persistence and lateral-movement primitives. A script in NETLOGON that no administrator can account for is a high-confidence indicator of past compromise or unmanaged change. Conversely, a user whose scriptPath points to a file that is missing from NETLOGON is a sign of stale automation that an attacker can resurrect by simply dropping a file of that name into the share. Without a maintained inventory, defenders cannot answer the basic question "what code executes when each user logs on" and cannot reason about blast radius for any of the downstream ADSCRIPT checks. Logon scripts execute on every workstation a user authenticates to, so a single compromised script reaches the entire user population mapped to it. Startup and shutdown scripts execute as SYSTEM on every domain-joined computer in scope of the GPO, which is the maximum local privilege.
Ruta de ataque
1. Reconnaissance: an attacker with any authenticated foothold queries the directory with Get-ADUser -Filter {scriptPath -like "*"} or LDAP equivalent to enumerate every user with an assigned logon script. 2. Target selection: the attacker prioritizes scripts referenced by privileged users, IT staff, or large user populations. Helpdesk and service-desk OUs are common targets because they touch many endpoints. 3. Write-access probe: the attacker checks the ACL on each referenced script and on NETLOGON itself. Misconfigurations that grant Authenticated Users, Domain Users, or Everyone modify rights, or write access to a parent folder, are exploited directly. 4. Orphan resurrection: where scriptPath points to a missing file, the attacker drops a script of the same name into NETLOGON. The next logon of any user with that scriptPath value runs attacker code in that user context (MITRE T1037.003). 5. ScriptPath hijack: with WriteProperty on the target user (often via abusable ACLs surfaced by BloodHound), the attacker rewrites scriptPath to a script they control, achieving code execution as the victim on next logon. 6. SYSTEM escalation: if the same approach is taken against a GPO startup script (where the attacker has edit rights on the GPO or write rights on the SYSVOL path), code runs as SYSTEM on every targeted computer. 7. Persistence: the change blends into normal directory traffic and survives password resets, since execution depends on the script content rather than any credential.
Cómo lo evalúa Guerrilla
Guerrilla queries the directory for all user objects with a non-empty scriptPath, parses every GPO in the domain for User and Computer script extensions (CSEs {42B5FAAE-6536-11D2-AE5A-0000F87571E3} for scripts), and enumerates the file listing of the NETLOGON share. Each script reference is recorded with its source (User.scriptPath, GPO Logon, GPO Logoff, GPO Startup, GPO Shutdown), the principal it runs as, the resolved UNC path, and the file metadata (size, last write time, owner). The four sets are joined on filename and full path to produce the orphan, missing, and matched lists. No misconfiguration is asserted at this stage: the check is informational, and produces the dataset consumed by ADSCRIPT-001, ADSCRIPT-002, ADSCRIPT-004 and the rest of the category.
Valor recomendado
Complete inventory of all logon scripts with documented purpose, owner, and last modification date
Remediación
Enumerate all user scriptPath attributes using Get-ADUser -Filter {scriptPath -like '*'} -Properties scriptPath. List all GPO-configured scripts from GPO reports. Inventory all files in the NETLOGON share. Cross-reference to identify orphaned scripts, unused scripts, and scripts referenced by user accounts but missing from NETLOGON. Document each script's purpose and owner.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CM-8, CM-8(1), CM-3
- MITRE ATT&CK
- T1059