Gpscript Execution

Title: Gpscript Execution
Status: test
Description:Detects the execution of the LOLBIN gpscript, which executes logon or startup scripts configured in Group Policy
References:
  -https://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/
  -https://lolbas-project.github.io/lolbas/Binaries/Gpscript/
Author: frack113
Date: 2022-05-16
modified:2023-06-14
Tags:

• -'attack.stealth'
• -'attack.t1218'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection_img:
Image|endswith:'\gpscript.exe' OriginalFileName:'GPSCRIPT.EXE'   selection_cli:
    CommandLine|contains:
      -' /logon'
      -' /startup'

  filter_main_svchost:
    ParentCommandLine: 'C:\windows\system32\svchost.exe -k netsvcs -p -s gpsvc'
  condition:all of selection_* and not 1 of filter_main_*
Falsepositives:
  -Legitimate uses of logon scripts distributed via group policy
Level: medium