Windows: GPO Startup/Logon Script Added to User or Computer Extensions

Flags GPO changes that add startup/logon scripts (SYSVOL scripts.ini) for user or computer targets using Windows directory/audit events.

FreeUnreviewedSigmamediumv1

windows-gpo-startup-logon-script-added-to-user-or-computer-extensions-123e4e6d

title: "Windows: GPO Startup/Logon Script Added to User or Computer Extensions"
id: 4cc71f1b-d49b-499f-9de9-03a2106a2e50
status: test
description: This rule identifies Windows Security events where a Group Policy Object (GPO) is modified to add startup or logon script configuration for either computer or user targets. Attackers commonly use GPO script settings to persist malicious commands across reboots and logons, blending into legitimate administrative workflows. It relies on audit file access events (Event IDs 5136 and 5145) and attribute/target name patterns consistent with the SYSVOL scripts.ini locations and specific GPO extension GUIDs.
references:
  - https://www.elastic.co/guide/en/security/current/startup-logon-script-added-to-group-policy-object.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_group_policy_startup_script_added_to_gpo.yml
author: Elastic, Josh Nickels, Marius Rothenbücher, Huntrule Team
date: 2024-09-06
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.defense-impairment
  - attack.t1484.001
  - attack.t1547
logsource:
  product: windows
  service: security
  definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure
detection:
  selection_eventid:
    EventID:
      - 5136
      - 5145
  selection_attributes_main:
    AttributeLDAPDisplayName:
      - gPCMachineExtensionNames
      - gPCUserExtensionNames
    AttributeValue|contains: 42B5FAAE-6536-11D2-AE5A-0000F87571E3
  selection_attributes_optional:
    AttributeValue|contains:
      - 40B6664F-4972-11D1-A7CA-0000F87571E3
      - 40B66650-4972-11D1-A7CA-0000F87571E3
  selection_share:
    ShareName|endswith: \SYSVOL
    RelativeTargetName|endswith:
      - \scripts.ini
      - \psscripts.ini
    AccessList|contains: "%%4417"
  condition: selection_eventid and (all of selection_attributes_* or selection_share)
falsepositives:
  - Legitimate execution by system administrators.
level: medium
license: DRL-1.1
related:
  - id: 123e4e6d-b123-48f8-b261-7214938acaf0
    type: derived

What it detects

This rule identifies Windows Security events where a Group Policy Object (GPO) is modified to add startup or logon script configuration for either computer or user targets. Attackers commonly use GPO script settings to persist malicious commands across reboots and logons, blending into legitimate administrative workflows. It relies on audit file access events (Event IDs 5136 and 5145) and attribute/target name patterns consistent with the SYSVOL scripts.ini locations and specific GPO extension GUIDs.

Known false positives

Legitimate execution by system administrators.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.