T1037.md

T1037 - Logon Scripts

Description from ATT&CK

### Windows

Windows allows logon scripts to be run whenever a specific user or group of users log into a system. (Citation: TechNet Logon Scripts) The scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server.

If adversaries can access these scripts, they may insert additional code into the logon script to execute their tools when a user logs in. This code can allow them to maintain persistence on a single system, if it is a local script, or to move laterally within a network, if the script is stored on a central server and pushed to many systems. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.

Mac

Mac allows login and logoff hooks to be run as root whenever a specific user logs into or out of a system. A login hook tells Mac OS X to execute a certain script when a user logs in, but unlike startup items, a login hook executes as root (Citation: creating login hook). There can only be one login hook at a time though. If adversaries can access these scripts, they can insert additional code to the script to execute their tools when a user logs in.

Atomic Tests

• Atomic Test #1 - Logon Scripts

• Atomic Test #2 - Scheduled Task Startup Script

• Atomic Test #3 - Logon Scripts - Mac

• Atomic Test #4 - Supicious vbs file run from startup Folder

• Atomic Test #5 - Supicious jse file run from startup Folder

• Atomic Test #6 - Supicious bat file run from startup Folder

Atomic Test #1 - Logon Scripts

Adds a registry value to run batch script created in the C:\Windows\Temp directory.

Supported Platforms: Windows

Inputs:

Name	Description	Type	Default Value
script_path	Path to .bat file	String	$env:SystemRoot\Temp\art.bat
script_command	Command To Execute	String	echo Art "Logon Script" atomic test was successful. >> %USERPROFILE%\desktop\T1037-log.txt

Attack Commands: Run with command_prompt!

echo cmd /c "#{script_command}" > #{script_path}
REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_SZ /d "#{script_path}"

Cleanup Commands:

REG.exe DELETE HKCU\Environment /v UserInitMprLogonScript /f
del #{script_path} >nul 2>nul
del "%USERPROFILE%\desktop\T1037-log.txt" >nul 2>nul

Atomic Test #2 - Scheduled Task Startup Script

Run an exe on user logon or system startup

Supported Platforms: Windows

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

schtasks /create /tn "T1037_OnLogon" /sc onlogon /tr "cmd.exe /c calc.exe"
schtasks /create /tn "T1037_OnStartup" /sc onstart /ru system /tr "cmd.exe /c calc.exe"

Cleanup Commands:

schtasks /delete /tn "T1037_OnLogon" /f
schtasks /delete /tn "T1037_OnStartup" /f

Atomic Test #3 - Logon Scripts - Mac

Mac logon script

Supported Platforms: macOS

Run it with these steps!

1. Create the required plist file

   sudo touch /private/var/root/Library/Preferences/com.apple.loginwindow.plist

2. Populate the plist with the location of your shell script

   sudo defaults write com.apple.loginwindow LoginHook /Library/Scripts/AtomicRedTeam.sh

3. Create the required plist file in the target user's Preferences directory

   touch /Users/$USER/Library/Preferences/com.apple.loginwindow.plist

4. Populate the plist with the location of your shell script

   defaults write com.apple.loginwindow LoginHook /Library/Scripts/AtomicRedTeam.sh

Atomic Test #4 - Supicious vbs file run from startup Folder

vbs files can be placed in and ran from the startup folder to maintain persistance

Supported Platforms: Windows

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

Copy-Item $PathToAtomicsFolder\T1037\src\vbsstartup.vbs "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\vbsstartup.vbs"
Copy-Item $PathToAtomicsFolder\T1037\src\vbsstartup.vbs "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vbsstartup.vbs"
cscript.exe "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\vbsstartup.vbs"
cscript.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vbsstartup.vbs"

Cleanup Commands:

Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\vbsstartup.vbs" -ErrorAction Ignore
Remove-Item "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vbsstartup.vbs" -ErrorAction Ignore

Atomic Test #5 - Supicious jse file run from startup Folder

jse files can be placed in and ran from the startup folder to maintain persistance

Supported Platforms: Windows

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

Copy-Item $PathToAtomicsFolder\T1037\src\jsestartup.jse "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\jsestartup.jse"
Copy-Item $PathToAtomicsFolder\T1037\src\jsestartup.jse "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\jsestartup.jse"
cscript.exe /E:Jscript "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\jsestartup.jse"
cscript.exe /E:Jscript "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\jsestartup.jse"

Cleanup Commands:

Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\jsestartup.jse" -ErrorAction Ignore
Remove-Item "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\jsestartup.jse" -ErrorAction Ignore

Atomic Test #6 - Supicious bat file run from startup Folder

bat files can be placed in and ran from the startup folder to maintain persistance

Supported Platforms: Windows

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

Copy-Item $PathToAtomicsFolder\T1037\src\batstartup.bat "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\batstartup.bat"
Copy-Item $PathToAtomicsFolder\T1037\src\batstartup.bat "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\batstartup.bat"
Start-Process "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\batstartup.bat"
Start-Process "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\batstartup.bat"

Cleanup Commands:

Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\batstartup.bat" -ErrorAction Ignore
Remove-Item "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\batstartup.bat" -ErrorAction Ignore