1200KM / detection
T1037.003 Network Logon Script — Detection Rules
Detection workspace for T1037.003 Network Logon Script: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0367 Detect Network Logon Script Abuse via Multi-Event Correlation on Windows
AN1034 Analytic 1034
Correlates Group Policy updates that configure network logon scripts with subsequent remote file execution behaviors triggered by user logons to identify potential persistence or execution chains tied to adversarial manipulation of logon scripts.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1037.003 simulation workspace
No reviewed association in this snapshot.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.