Suspicious Execution of Logon Script from SMB/Netlogon
Detects the execution of command-line interpreters (cmd.exe, powershell.exe, wscript.exe, cscript.exe) from the Netlogon or Sysvol shares. This activity is highly suspicious as these shares are typically used for Group Policy and logon scripts, not for direct execution of interactive shells or scripting engines by users or processes. This could indicate an adversary attempting to execute malicious code or scripts from a central, often replicated, location within a Windows domain environment, potentially for lateral movement, persistence, or privilege escalation.
Microsoft Sentinel (KQL)
