Windows gpscript.exe execution with /logon or /startup parameters

Flags gpscript.exe running with /logon or /startup, suggestive of Group Policy script execution abuse.

FreeUnreviewedSigmamediumv1

windows-gpscript-exe-execution-with-logon-or-startup-parameters-1e59c230

title: Windows gpscript.exe execution with /logon or /startup parameters
id: e6c0aacc-29de-4af4-a049-a20db74e7d8a
status: test
description: This rule identifies execution of gpscript.exe with either /logon or /startup, indicating the process is being used to run Group Policy–configured logon or startup scripts. Attackers can abuse this LOLBIN to stealthily trigger script activity during user logon or system startup. It relies on Windows process creation telemetry, matching the gpscript executable and the presence of the relevant command-line switches, while excluding cases where the parent is the gpsvc service hosted by svchost.exe.
references:
  - https://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/
  - https://lolbas-project.github.io/lolbas/Binaries/Gpscript/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_gpscript.yml
author: frack113, Huntrule Team
date: 2022-05-16
modified: 2023-06-14
tags:
  - attack.stealth
  - attack.t1218
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \gpscript.exe
    - OriginalFileName: GPSCRIPT.EXE
  selection_cli:
    CommandLine|contains:
      - " /logon"
      - " /startup"
  filter_main_svchost:
    ParentCommandLine: C:\windows\system32\svchost.exe -k netsvcs -p -s gpsvc
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Legitimate uses of logon scripts distributed via group policy
level: medium
license: DRL-1.1
related:
  - id: 1e59c230-6670-45bf-83b0-98903780607e
    type: derived

What it detects

This rule identifies execution of gpscript.exe with either /logon or /startup, indicating the process is being used to run Group Policy–configured logon or startup scripts. Attackers can abuse this LOLBIN to stealthily trigger script activity during user logon or system startup. It relies on Windows process creation telemetry, matching the gpscript executable and the presence of the relevant command-line switches, while excluding cases where the parent is the gpsvc service hosted by svchost.exe.

Known false positives

Legitimate uses of logon scripts distributed via group policy

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.