Gpscript Execution for Logon or Startup Scripts
Detects the execution of the LOLBIN (Living Off the Land Binaries and Scripts) `gpscript.exe` when it is used to execute logon or startup scripts configured in Group Policy. This rule specifically looks for `gpscript.exe` being executed with the `/logon` or `/startup` command-line arguments, while filtering out legitimate executions where `gpscript.exe` is parented by `svchost.exe` with the `gpsvc` service.
Sigma
