AN1034
Analytic 1034
Windows
Correlates Group Policy updates that configure network logon scripts with subsequent remote file execution behaviors triggered by user logons to identify potential persistence or execution chains tied to adversarial manipulation of logon scripts.
WinEventLog:Security
EventCode=5145
WinEventLog:Security
EventCode=4688
WinEventLog:System
EventCode=4016, 5312
[TargetObject]
Path to network-based script execution; tuning required for environment-specific network shares.
[ParentProcessName]
Initial execution process that launches the script; may vary depending on script language or user context.
[TimeWindow]
Acceptable time window to correlate Group Policy update with script execution (e.g., 2–10 minutes).
[UserContext]
Account initiating execution; useful for filtering known administrative activity.