Startup/Logon Script Added to Group Policy Object

Title: Startup/Logon Script Added to Group Policy Object
Status: test
Description:Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.
References:
  -https://www.elastic.co/guide/en/security/current/startup-logon-script-added-to-group-policy-object.html
Author: Elastic, Josh Nickels, Marius Rothenbücher
Date: 2024-09-06
modified:None
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.defense-impairment'
• -'attack.t1484.001'
• -'attack.t1547'

Logsource:

• product: windows
• service: security
• definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure

Detection:
  selection_eventid:
    EventID:
      -'5136'
      -'5145'

  selection_attributes_main:
    AttributeLDAPDisplayName:
      -'gPCMachineExtensionNames'
      -'gPCUserExtensionNames'

    AttributeValue|contains: '42B5FAAE-6536-11D2-AE5A-0000F87571E3'
  selection_attributes_optional:
    AttributeValue|contains:
      -'40B6664F-4972-11D1-A7CA-0000F87571E3'
      -'40B66650-4972-11D1-A7CA-0000F87571E3'

  selection_share:
    ShareName|endswith: '\SYSVOL'
    RelativeTargetName|endswith:
      -'\scripts.ini'
      -'\psscripts.ini'

    AccessList|contains: '%%4417'
  condition:selection_eventid and (all of selection_attributes_* or selection_share)
Falsepositives:
  -Legitimate execution by system administrators.
Level: medium