Logon Script (Windows)
Subtechnique · ATTACK:enterprise:T1037.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1037.001",
"title": "Logon Script (Windows)",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1037/001",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--eb125d40-0b2d-41ac-a71a-3229241c2cd3",
"external_id": "T1037.001",
"domain": "enterprise",
"created": "2020-01-10T03:43:37.211Z",
"modified": "2025-10-24T17:49:33.610Z",
"version": "1.0",
"aliases": [
],
"tactics": [
"persistence",
"privilege-escalation"
],
"source_references": [
{
"source_name": "Hexacorn Logon Scripts",
"url": "http://www.hexacorn.com/blog/2014/11/14/beyond-good-ol-run-key-part-18/"
},
{
"source_name": "TechNet Logon Scripts",
"url": "https://technet.microsoft.com/en-us/library/cc758918(v=ws.10).aspx"
}
]
}Explicit source assertions (8)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:M1024 → mitigates → ATTACK:enterprise:T1037.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f7dd352-4e6b-4852-a995-7b22c98b4fd2
ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1037.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--237d098d-f796-49a0-bdc8-61909cd74feb
Unit 42 Playbook Dec 2017ATTACK:enterprise:T1037.001 → subtechnique-of → ATTACK:enterprise:T1037
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--27fcfb28-a452-42fe-b33e-0bb76550e883
ATTACK:enterprise:S0438 → uses → ATTACK:enterprise:T1037.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--29e33373-f05e-421b-9b5d-fc2d617b36af
ESET Attor Oct 2019ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1037.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--70d5a73c-cc14-410a-a430-5948cd21532f
ESET Sednit Part 1 · Talos Seduploader Oct 2017ATTACK:enterprise:S0526 → uses → ATTACK:enterprise:T1037.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--89bed5a5-b40c-4d27-87c7-a077d1cb2e59
Cybereason Kimsuky November 2020ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1037.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a0f218db-2d79-43b7-b2b8-ef1199ada766
ESET Zebrocy Nov 2018ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1037.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f9283994-d216-4796-989d-a375eb4834a9
Morphisec Cobalt Gang Oct 2018