Backdoors & Breaches: Logon Scripts

This post explains how attackers abuse Windows/Active Directory logon-script execution paths—such as Registry Run/RunOnce keys, startup folders, SYSVOL logon scripts, Group Policy Object modifications, and user ScriptPath changes—to gain execution, persistence, and lateral movement. It advises defenders to monitor key registry and filesystem locations, regularly audit NTFS and GPO permissions, and leverage tools like BloodHound to identify risky delegations and misconfigurations.