Windows: Suspicious GrpConv Utility Execution for .grp Conversion or Persistence

title: "Windows: Suspicious GrpConv Utility Execution for .grp Conversion or Persistence"
id: fe8c41f7-6504-4abe-9959-d36aa578b958
status: test
description: This rule flags process executions where the command line contains arguments consistent with running GrpConv (grpconv.exe/grpconv) with an output conversion option (-o). Such behavior may indicate an attempt to convert Windows 3.x .grp files or use GrpConv as part of a persistence workflow. It relies on Windows process creation telemetry with access to the command line to identify the specific -o usage patterns.
references:
  - https://twitter.com/0gtweet/status/1526833181831200770
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_susp_grpconv.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-05-19
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - grpconv.exe -o
      - grpconv -o
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f14e169e-9978-4c69-acb3-1cff8200bc36
    type: derived