Logon Initialization Script Dropped via Network Share

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects when a batch script (.bat) is dropped onto a network share, specifically targeting the NETLOGON share, which is often used for logon scripts. This activity can be indicative of an attacker attempting to establish persistence or execute malicious code on systems that process logon scripts from this share. The rule triggers if three such events are observed from the same source within 60 seconds.