All Detections

Logon Script Written to NETLOGON Share

avatar
Darshan Thummar@Mighty
updated Jun 13, 2026004

Detects malicious logon scripts deployed to the NETLOGON share for domain-wide execution

Microsoft Sentinel (KQL)