Windows: GPO Modification Adds Startup/Logon Script References

Flags GPO changes that add startup/logon scripts (SYSVOL scripts.ini) for user or computer targets using Windows directory/audit events.

FreeReviewedSigma · Medium · v2

Product: windows
Service: security
Author: Elastic, Josh Nickels, Marius Rothenbücher (SigmaHQ), DRL 1.1
Published: 2024-09-06
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Persistence → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1547Boot or Logon Autostart Execution
Priv Esc
- T1484.001Group Policy Modification
- T1547Boot or Logon Autostart Execution
Defense Evasion
- T1484.001Group Policy Modification
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows Security events where a Group Policy Object is modified to add or reference startup/logon script entries for either computer or user extensions. Attackers commonly abuse GPO script mechanisms to establish persistence and run code in the context of targeted accounts or machines. The detection relies on object access events (EventID 5136/5145) along with LDAP attribute names and values that match known script-related identifiers, and on SYSVOL path targets pointing to scripts.ini or psscripts.ini.

Reporting behind it

Related detections9 linkedT1484.001 — drag to rearrange

Suspicious Boot Verification Program Persistence via Registry (via registry_set)

Suspicious Modification of a Sensitive Group Policy - GPO (via security)

SwimSnake Driver Execution Persistence via Session Manager PlatformExecute (via registry_set)

Suspicious Group Policy File System Path Redirection via Directory Service Change

Malicious GPO Permission Abuse via SharpGPOAbuse

Suspicious Session Manager Execute Value Modification for Persistence (via registry_set)

Suspicious Executable Launched from SYSVOL Share

Suspicious RDP Wds StartupPrograms Persistence Modification (via registry_set)

Malicious SharpGPOAbuse GPO Modification Tool from Public Directory

Windows: GPO Modification Adds Startup/Logon Script References

Pivot detection · T1484.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-gpo-startup-logon-script-added-to-user-or-computer-extensions-123e4e6d

title: "Windows: GPO Modification Adds Startup/Logon Script References"
id: 4cc71f1b-d49b-499f-9de9-03a2106a2e50
status: test
description: This rule identifies Windows Security events where a Group Policy Object is modified to add or reference startup/logon script entries for either computer or user extensions. Attackers commonly abuse GPO script mechanisms to establish persistence and run code in the context of targeted accounts or machines. The detection relies on object access events (EventID 5136/5145) along with LDAP attribute names and values that match known script-related identifiers, and on SYSVOL path targets pointing to scripts.ini or psscripts.ini.
references:
  - https://www.elastic.co/guide/en/security/current/startup-logon-script-added-to-group-policy-object.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_group_policy_startup_script_added_to_gpo.yml
author: Elastic, Josh Nickels, Marius Rothenbücher, Huntrule Team
date: 2024-09-06
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.defense-impairment
  - attack.t1484.001
  - attack.t1547
logsource:
  product: windows
  service: security
  definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure
detection:
  selection_eventid:
    EventID:
      - 5136
      - 5145
  selection_attributes_main:
    AttributeLDAPDisplayName:
      - gPCMachineExtensionNames
      - gPCUserExtensionNames
    AttributeValue|contains: 42B5FAAE-6536-11D2-AE5A-0000F87571E3
  selection_attributes_optional:
    AttributeValue|contains:
      - 40B6664F-4972-11D1-A7CA-0000F87571E3
      - 40B66650-4972-11D1-A7CA-0000F87571E3
  selection_share:
    ShareName|endswith: \SYSVOL
    RelativeTargetName|endswith:
      - \scripts.ini
      - \psscripts.ini
    AccessList|contains: "%%4417"
  condition: selection_eventid and (all of selection_attributes_* or selection_share)
falsepositives:
  - Legitimate execution by system administrators.
level: medium
license: DRL-1.1
related:
  - id: 123e4e6d-b123-48f8-b261-7214938acaf0
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL