{"id":"123e4e6d-b123-48f8-b261-7214938acaf0","title":"Startup/Logon Script Added to Group Policy Object","description":"Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.\n","author":"Elastic, Josh Nickels, Marius Rothenbücher","status":"test","level":"medium","date":"2024-09-06","modified":"","tags":["attack.persistence","attack.privilege-escalation","attack.defense-impairment","attack.t1484.001","attack.t1547"],"technique_ids":["T1484.001","T1547"],"logsource":{"product":"windows","service":"security","definition":"The advanced audit policy setting \"Object Access > Audit Detailed File Share\" must be configured for Success/Failure"},"falsepositives":["Legitimate execution by system administrators."],"references":["https://www.elastic.co/guide/en/security/current/startup-logon-script-added-to-group-policy-object.html"],"source_path":"rules/windows/builtin/security/win_security_susp_group_policy_startup_script_added_to_gpo.yml","source_sha256":"aa1fcb559701ae8e1244b65f790ee4ae2905df123c484a14baf99bf9289ef674","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_susp_group_policy_startup_script_added_to_gpo.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Startup/Logon Script Added to Group Policy Object\nid: 123e4e6d-b123-48f8-b261-7214938acaf0\nstatus: test\ndescription: |\n    Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.\nreferences:\n    - https://www.elastic.co/guide/en/security/current/startup-logon-script-added-to-group-policy-object.html\nauthor: Elastic, Josh Nickels, Marius Rothenbücher\ndate: 2024-09-06\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.defense-impairment\n    - attack.t1484.001\n    - attack.t1547\nlogsource:\n    product: windows\n    service: security\n    definition: 'The advanced audit policy setting \"Object Access > Audit Detailed File Share\" must be configured for Success/Failure'\ndetection:\n    selection_eventid:\n        EventID:\n            - 5136\n            - 5145\n    selection_attributes_main:\n        AttributeLDAPDisplayName:\n            - 'gPCMachineExtensionNames'\n            - 'gPCUserExtensionNames'\n        AttributeValue|contains: '42B5FAAE-6536-11D2-AE5A-0000F87571E3'\n    selection_attributes_optional:\n        AttributeValue|contains:\n            - '40B6664F-4972-11D1-A7CA-0000F87571E3'\n            - '40B66650-4972-11D1-A7CA-0000F87571E3'\n    selection_share:\n        ShareName|endswith: '\\SYSVOL'\n        RelativeTargetName|endswith:\n            - '\\scripts.ini'\n            - '\\psscripts.ini'\n        AccessList|contains: '%%4417'\n    condition: selection_eventid and (all of selection_attributes_* or selection_share)\nfalsepositives:\n    - Legitimate execution by system administrators.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1484.001","id":"T1484.001","name":"Group Policy Modification","page":"techniques/enterprise/T1484.001/"},{"key":"enterprise/T1547","id":"T1547","name":"Boot or Logon Autostart Execution","page":"techniques/enterprise/T1547/"}],"data_path":"data/detection-rules/123e4e6d-b123-48f8-b261-7214938acaf0.json","kind":"sigma"}