All Detections

Gpscript Execution

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 2025013

Detects the execution of the LOLBIN gpscript, which executes logon or startup scripts configured in Group Policy

Sigma