Gpscript Execution

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: frack113
Source: github.com/SigmaHQ/sigma

Detects the execution of the LOLBIN gpscript, which executes logon or startup scripts configured in Group Policy

Known false positives

Legitimate uses of logon scripts distributed via group policy

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1218` System Binary Proxy Execution

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Gpscript Execution
id: 1e59c230-6670-45bf-83b0-98903780607e
status: test
description: Detects the execution of the LOLBIN gpscript, which executes logon or startup scripts configured in Group Policy
references:
    - https://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/
    - https://lolbas-project.github.io/lolbas/Binaries/Gpscript/
author: frack113
date: 2022-05-16
modified: 2023-06-14
tags:
    - attack.stealth
    - attack.t1218
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\gpscript.exe'
        - OriginalFileName: 'GPSCRIPT.EXE'
    selection_cli:
        CommandLine|contains:
            - ' /logon'
            - ' /startup'
    filter_main_svchost:
        ParentCommandLine: 'C:\windows\system32\svchost.exe -k netsvcs -p -s gpsvc'
    condition: all of selection_* and not 1 of filter_main_*
falsepositives:
    - Legitimate uses of logon scripts distributed via group policy
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_* and not 1 of filter_main_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\gpscript.exe'
    - OriginalFileName: 'GPSCRIPT.EXE'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains:
        - ' /logon'
        - ' /startup'

Stage 3: `not filter_main_svchost`

filter_main_svchost:
    ParentCommandLine: 'C:\windows\system32\svchost.exe -k netsvcs -p -s gpsvc'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`ParentCommandLine`	eq	`C:\windows\system32\svchost.exe -k netsvcs -p -s gpsvc`	`excludes:ParentCommandLine` `field:"ParentCommandLine" value:"C:\windows\system32\svchost.exe -k netsvcs -p -s gpsvc"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`/logon` `/startup`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\gpscript.exe`	`field:"Image" kind:ends_with value:"\gpscript.exe"`
`OriginalFileName`	eq	`GPSCRIPT.EXE`	`field:"OriginalFileName" kind:eq value:"GPSCRIPT.EXE"`