LOL · Binary

Gpscript.exe

2 techniquesWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Executes logon scripts configured in Group Policy.

Use Add local group policy logon script to execute file and hide from defensive counter measures

Gpscript /logon

Evidence: Upstream reference
Environment: Local host
Context: admin
Native: Execute
MITRE: T1218
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_gpscript.yml
IOC: Scripts added in local group policy
IOC: Execution of Gpscript.exe after logon
Refs: oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/
lolbas-project.github.io/lolbas/Binaries/Gpscript/

ExecutionWindows

Executes startup scripts configured in Group Policy

Use Add local group policy logon script to execute file and hide from defensive counter measures

Gpscript /startup

Evidence: Upstream reference
Environment: Local host
Context: admin
Native: Execute
MITRE: T1218
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_gpscript.yml
IOC: Scripts added in local group policy
IOC: Execution of Gpscript.exe after logon
Refs: oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/
lolbas-project.github.io/lolbas/Binaries/Gpscript/