Windows Logon Script Written to NETLOGON Share

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects when a Windows logon script (specifically a .bat file) is written to the NETLOGON share over SMB. This activity is often associated with persistence techniques where an attacker modifies or creates a logon script to execute malicious code when a user logs on to a domain-joined machine.