Network Logon Script Deployed via Domain Share

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects the deployment of a network logon script named 'logon.bat' within the 'SYSVOL' share over SMB (port 445). This activity is often associated with persistence techniques where an attacker modifies or creates logon scripts to execute malicious code when users log in to the domain.