Gpscript.exe

type: OSBinaries

Used by group policy to process scripts

Full path

C:\Windows\System32\gpscript.exe
C:\Windows\SysWOW64\gpscript.exe

Commands

ExecuteAdministrator T1218
Add local group policy logon script to execute file and hide from defensive counter measures
```
Gpscript /logon
```
Executes logon scripts configured in Group Policy.
os: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute: CMD
ExecuteAdministrator T1218
Add local group policy logon script to execute file and hide from defensive counter measures
```
Gpscript /startup
```
Executes startup scripts configured in Group Policy
os: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute: CMD

Detection

Sigma https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_gpscript.yml
IOCScripts added in local group policy
IOCExecution of Gpscript.exe after logon

Resources

https://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/

acknowledgement: Oddvar Moe @oddvarmoe