Windows: GPO Modification Adds Startup/Logon Script References
Flags GPO changes that add startup/logon scripts (SYSVOL scripts.ini) for user or computer targets using Windows directory/audit events.
- Product
- windows
- Service
- security
- Author
- Elastic, Josh Nickels, Marius Rothenbücher (SigmaHQ), DRL 1.1
- Published
- 2024-09-06
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows Security events where a Group Policy Object is modified to add or reference startup/logon script entries for either computer or user extensions. Attackers commonly abuse GPO script mechanisms to establish persistence and run code in the context of targeted accounts or machines. The detection relies on object access events (EventID 5136/5145) along with LDAP attribute names and values that match known script-related identifiers, and on SYSVOL path targets pointing to scripts.ini or psscripts.ini.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: GPO Modification Adds Startup/Logon Script References"
id: 4cc71f1b-d49b-499f-9de9-03a2106a2e50
status: test
description: This rule identifies Windows Security events where a Group Policy Object is modified to add or reference startup/logon script entries for either computer or user extensions. Attackers commonly abuse GPO script mechanisms to establish persistence and run code in the context of targeted accounts or machines. The detection relies on object access events (EventID 5136/5145) along with LDAP attribute names and values that match known script-related identifiers, and on SYSVOL path targets pointing to scripts.ini or psscripts.ini.
references:
- https://www.elastic.co/guide/en/security/current/startup-logon-script-added-to-group-policy-object.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_group_policy_startup_script_added_to_gpo.yml
author: Elastic, Josh Nickels, Marius Rothenbücher, Huntrule Team
date: 2024-09-06
tags:
- attack.persistence
- attack.privilege-escalation
- attack.defense-impairment
- attack.t1484.001
- attack.t1547
logsource:
product: windows
service: security
definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure
detection:
selection_eventid:
EventID:
- 5136
- 5145
selection_attributes_main:
AttributeLDAPDisplayName:
- gPCMachineExtensionNames
- gPCUserExtensionNames
AttributeValue|contains: 42B5FAAE-6536-11D2-AE5A-0000F87571E3
selection_attributes_optional:
AttributeValue|contains:
- 40B6664F-4972-11D1-A7CA-0000F87571E3
- 40B66650-4972-11D1-A7CA-0000F87571E3
selection_share:
ShareName|endswith: \SYSVOL
RelativeTargetName|endswith:
- \scripts.ini
- \psscripts.ini
AccessList|contains: "%%4417"
condition: selection_eventid and (all of selection_attributes_* or selection_share)
falsepositives:
- Legitimate execution by system administrators.
level: medium
license: DRL-1.1
related:
- id: 123e4e6d-b123-48f8-b261-7214938acaf0
type: derived