Network Logon Script is ATT&CK T1037.003. It is mapped to Persistence and Privilege Escalation and applies to Windows.
How attackers use it
MITRE explains that network logon scripts can be assigned using Active Directory or Group Policy Objects. They run with the privileges of the user they are assigned to. Depending on the systems in the network, initializing one of these scripts could apply to more than one system, or potentially all of them. That reach is what makes this variant more serious than a single machine's logon script. Local credentials or an administrator account may be needed, depending on how access to the scripts is configured.
The MITRE procedure example is a ransomware family that used the domain's NETLOGON share to distribute its payload to all domain-joined systems.
How to detect it
The MITRE analytic correlates Group Policy updates that configure network logon scripts with later remote file execution triggered by user logons. In other words, watch for a change to the script assignment, then look for the script or a program it points to running on endpoints soon after.
Data to collect: Active Directory and Group Policy change auditing, file change auditing on the NETLOGON and SYSVOL shares, and process creation on endpoints at logon time.
How to reduce the risk
MITRE lists one mitigation: restrict file and directory permissions. Limit write access to logon scripts to specific administrators. In practice that means tight access control lists on the NETLOGON and SYSVOL shares and a short list of accounts allowed to edit Group Policy.
