Windows grpconv Utility Execution with Output Option

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1547Boot or Logon Autostart Execution
Priv Esc
- T1547Boot or Logon Autostart Execution
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation events where the command line contains an invocation of grpconv.exe with an output option ("grpconv.exe -o" or "grpconv -o"). Attackers may use this utility to convert legacy Windows 3.x .grp files or as part of persistence-related activity, making abnormal utility execution noteworthy. It relies on process creation telemetry, specifically the recorded command line for the spawned grpconv process.

Reporting behind it

Related detections8 linkedT1547 — drag to rearrange

Suspicious Boot Verification Program Persistence via Registry (via registry_set)

SwimSnake Driver Execution Persistence via Session Manager PlatformExecute (via registry_set)

Suspicious Session Manager Execute Value Modification for Persistence (via registry_set)

Suspicious RDP Wds StartupPrograms Persistence Modification (via registry_set)

Windows: GPO Modification Adds Startup/Logon Script References

Windows Explorer ZIP Extraction Dropping Startup Folder Shortcut

Windows: Suspicious Driver Installation via pnputil.exe

Windows Registry Run Key Modification via winekey or team9 backdoor

Windows grpconv Utility Execution with Output Option

Pivot detection · T1547 · 8 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-suspicious-grpconv-utility-execution-for-grp-conversion-or-persistence-f14e169e

title: Windows grpconv Utility Execution with Output Option
id: fe8c41f7-6504-4abe-9959-d36aa578b958
status: test
description: This rule flags Windows process creation events where the command line contains an invocation of grpconv.exe with an output option ("grpconv.exe -o" or "grpconv -o"). Attackers may use this utility to convert legacy Windows 3.x .grp files or as part of persistence-related activity, making abnormal utility execution noteworthy. It relies on process creation telemetry, specifically the recorded command line for the spawned grpconv process.
references:
  - https://twitter.com/0gtweet/status/1526833181831200770
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_susp_grpconv.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-05-19
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - grpconv.exe -o
      - grpconv -o
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f14e169e-9978-4c69-acb3-1cff8200bc36
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL