Startup/Logon Script added to Group Policy Object

  1[metadata]
  2creation_date = "2021/11/08"
  3integration = ["system", "windows"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = "Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects."
 10false_positives = ["Legitimate Administrative Activity"]
 11index = ["logs-system.security*", "logs-windows.forwarded*", "winlogbeat-*"]
 12language = "eql"
 13license = "Elastic License v2"
 14name = "Startup/Logon Script added to Group Policy Object"
 15note = """## Triage and analysis
 16
 17### Investigating Startup/Logon Script added to Group Policy Object
 18
 19Group Policy Objects (GPOs) can be used by attackers to instruct arbitrarily large groups of clients to execute specified commands at startup, logon, shutdown, and logoff. This is done by creating or modifying the `scripts.ini` or `psscripts.ini` files. The scripts are stored in the following paths:
 20  - `<GPOPath>\\Machine\\Scripts\\`
 21  - `<GPOPath>\\User\\Scripts\\`
 22
 23#### Possible investigation steps
 24
 25- This attack abuses a legitimate mechanism of Active Directory, so it is important to determine whether the activity is legitimate and the administrator is authorized to perform this operation.
 26- Retrieve the contents of the `ScheduledTasks.xml` file, and check the `<Command>` and `<Arguments>` XML tags for any potentially malicious commands or binaries.
 27- Investigate other alerts associated with the user/host during the past 48 hours.
 28- Scope which objects may be compromised by retrieving information about which objects are controlled by the GPO.
 29
 30### False positive analysis
 31
 32- Verify if the execution is legitimately authorized and executed under a change management process.
 33
 34### Related rules
 35
 36- Group Policy Abuse for Privilege Addition - b9554892-5e0e-424b-83a0-5aef95aa43bf
 37- Scheduled Task Execution at Scale via GPO - 15a8ba77-1c13-4274-88fe-6bd14133861e
 38
 39### Response and remediation
 40
 41- Initiate the incident response process based on the outcome of the triage.
 42- The investigation and containment must be performed in every computer controlled by the GPO, where necessary.
 43- Remove the script from the GPO.
 44- Check if other GPOs have suspicious scripts attached.
 45- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 46- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 47"""
 48references = [
 49    "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0025_windows_audit_directory_service_changes.md",
 50    "https://github.com/atc-project/atc-data/blob/f2bbb51ecf68e2c9f488e3c70dcdd3df51d2a46b/docs/Logging_Policies/LP_0029_windows_audit_detailed_file_share.md",
 51    "https://labs.f-secure.com/tools/sharpgpoabuse",
 52]
 53risk_score = 47
 54rule_id = "16fac1a1-21ee-4ca6-b720-458e3855d046"
 55setup = """## Setup
 56
 57The following Windows audit policies must be enabled to generate the events used by this rule:
 58- [Audit Directory Service Changes](https://ela.st/audit-directory-service-changes)
 59- [Audit Detailed File Share](https://ela.st/audit-detailed-file-share)
 60"""
 61severity = "medium"
 62tags = [
 63    "Domain: Endpoint",
 64    "OS: Windows",
 65    "Use Case: Threat Detection",
 66    "Tactic: Privilege Escalation",
 67    "Data Source: Active Directory",
 68    "Resources: Investigation Guide",
 69    "Use Case: Active Directory Monitoring",
 70    "Data Source: Windows Security Event Logs",
 71    "Noise: Low",
 72    "Performance: Normal",
 73    "Rule Type: Event Correlation (EQL)",
 74    "Platform: Windows",
 75]
 76timestamp_override = "event.ingested"
 77type = "eql"
 78
 79query = '''
 80any where host.os.type == "windows" and event.code in ("5136", "5145") and
 81(
 82  (
 83    winlog.event_data.AttributeLDAPDisplayName : (
 84      "gPCMachineExtensionNames",
 85      "gPCUserExtensionNames"
 86    ) and
 87    winlog.event_data.AttributeValue : "*42B5FAAE-6536-11D2-AE5A-0000F87571E3*" and
 88    winlog.event_data.AttributeValue : (
 89      "*40B66650-4972-11D1-A7CA-0000F87571E3*",
 90      "*40B6664F-4972-11D1-A7CA-0000F87571E3*"
 91    )
 92  ) or
 93  (
 94    winlog.event_data.ShareName : "\\\\*\\SYSVOL" and
 95    winlog.event_data.RelativeTargetName : ("*\\scripts.ini", "*\\psscripts.ini") and
 96    winlog.event_data.AccessList:"*%%4417*"
 97  )
 98)
 99'''
100
101
102[[rule.threat]]
103framework = "MITRE ATT&CK"
104
105[[rule.threat.technique]]
106id = "T1484"
107name = "Domain or Tenant Policy Modification"
108reference = "https://attack.mitre.org/techniques/T1484/"
109
110[[rule.threat.technique.subtechnique]]
111id = "T1484.001"
112name = "Group Policy Modification"
113reference = "https://attack.mitre.org/techniques/T1484/001/"
114
115[[rule.threat.technique]]
116id = "T1547"
117name = "Boot or Logon Autostart Execution"
118reference = "https://attack.mitre.org/techniques/T1547/"
119
120[rule.threat.tactic]
121id = "TA0004"
122name = "Privilege Escalation"
123reference = "https://attack.mitre.org/tactics/TA0004/"
124
125[[rule.threat]]
126framework = "MITRE ATT&CK"
127
128[[rule.threat.technique]]
129id = "T1037"
130name = "Boot or Logon Initialization Scripts"
131reference = "https://attack.mitre.org/techniques/T1037/"
132
133[rule.threat.tactic]
134id = "TA0003"
135name = "Persistence"
136reference = "https://attack.mitre.org/tactics/TA0003/"