windows enabled community high v1.0.0

gpscript

Used by group policy to process scripts Located at: C:\Windows\System32\gpscript.exe; C:\Windows\SysWOW64\gpscript.exe.

📋 Live Preview 
gpscript
gpscript

Sandbox: execFile · Timeout: 30s

Capabilities

security.execution.command

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

Executes logon scripts configured in Group Policy. (Add local group policy logon script to execute file and hide from defensive counter measures)

Gpscript /logon

Executes startup scripts configured in Group Policy (Add local group policy logon script to execute file and hide from defensive counter measures)

Gpscript /startup

Detection

TypeRule / Indicator
sigma https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_gpscript.yml
ioc Scripts added in local group policy
ioc Execution of Gpscript.exe after logon

Documentation

gpscript

gpscript is a Windows LOLBin. Used by group policy to process scripts Located at: C:\Windows\System32\gpscript.exe; C:\Windows\SysWOW64\gpscript.exe.

References