LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Gpscript.exe

View source

Used by group policy to process scripts

Execute
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute2

EXAMPLE 01T1218

Executes logon scripts configured in Group Policy.

COMMAND
Gpscript /logon
USE CASE
Add local group policy logon script to execute file and hide from defensive counter measures
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · CMD
EXAMPLE 02T1218

Executes startup scripts configured in Group Policy

COMMAND
Gpscript /startup
USE CASE
Add local group policy logon script to execute file and hide from defensive counter measures
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · CMD
02 / ON DISK

Known paths

C:\Windows\System32\gpscript.exe
C:\Windows\SysWOW64\gpscript.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    Scripts added in local group policy

  • IOC

    Execution of Gpscript.exe after logon

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Oddvar Moe@oddvarmoe