Logon Initialization Script Dropped to Network Share
Detects logon scripts dropped to NETLOGON or SYSVOL for domain-wide execution
Microsoft Sentinel (KQL)

Detects logon scripts dropped to NETLOGON or SYSVOL for domain-wide execution

Already have an account?