LOL · Binary

Gpscript.exe

2 techniques WindowsLOLBAS GPL-3.0

Execute

Execution Windows

Executes logon scripts configured in Group Policy.

Use Add local group policy logon script to execute file and hide from defensive counter measures

Gpscript /logon

Context: admin
Native: Execute
MITRE: T1218
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_gpscript.yml
IOC: Scripts added in local group policy
IOC: Execution of Gpscript.exe after logon
Refs: oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/
lolbas-project.github.io/lolbas/Binaries/Gpscript/

Execute

Execution Windows

Executes startup scripts configured in Group Policy

Use Add local group policy logon script to execute file and hide from defensive counter measures

Gpscript /startup

Context: admin
Native: Execute
MITRE: T1218
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_gpscript.yml
IOC: Scripts added in local group policy
IOC: Execution of Gpscript.exe after logon
Refs: oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/
lolbas-project.github.io/lolbas/Binaries/Gpscript/