Query: alert when Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.
Matching passage: Sigma rule: Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.. Logsource: windows / security. Rule: title: Startup/Logon Script Added to Group Policy Object id: 123e4e6d-b123-48f8-b261-7214938acaf0 status: test description: 'Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects. ' references: - https://www.elastic.co/guide/en/security/current/startup-logon-script-added-to-group-policy-object.html author: Elastic, Josh Nickels, Marius Rothenbücher date: 2024-09-06 tags: - attack.persistence - attack.privilege-escalation - attack.defense-impairment - attack.t1484.001 - attack.t1547 logsource: product: windows service: security definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure detection: selection_eventid: EventID: - 5136 - 5145 selection_attributes_main: AttributeLDAPDisplayName: - gPCMachineExtensionNames - gPCUserExtensionNames AttributeValue|contains: 42B5FAAE-6536-11D2-AE5A-0000F87571E3 selection_attributes_optional: AttributeValue|contains: - 40B6664F-4972-11D1-A7CA-0000F87571E3 - 40B66650-4972-11D1-A7CA-0000F87571E3 selection_share: ShareName|endswith: \SYSVOL RelativeTargetName|endswith: - \scripts.ini - \psscripts.ini AccessList|contains: '%%4417' condition: selection_eventid and (all of selection_attributes_* or selection_share) falsepositives: - Legitimate execution by system administrators. level: medium
Near-miss passage: Sigma rule: Detects execution of the "wusa.exe" (Windows Update Standalone Installer) utility by a parent process that is located in. Logsource: windows / process_creation. Rule: title: Wusa.EXE Executed By Parent Process Located In Suspicious Location id: ef64fc9c-a45e-43cc-8fd8-7d75d73b4c99 status: test description: 'Detects execution of the "wusa.exe" (Windows Update Standalone Installer) utility by a parent process that is located in a suspicious location. Attackers could instantiate an instance of "wusa.exe" in order to bypass User Account Control (UAC). They can duplicate the access token from "wusa.exe" to gain elevated privileges. ' references: - https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document author: X__Junior (Nextron Systems) date: 2023-11-26 modified: 2024-08-15 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \wusa.exe selection_paths_1: ParentImage|contains: - :\Perflogs\ - :\Users\Public\ - :\Windows\Temp\ - \Appdata\Local\Temp\ - \Temporary Internet selection_paths_2: - ParentImage|contains|all: - :\Users\ - \Favorites\ - ParentImage|contains|all: - :\Users\ - \Favourites\ - ParentImage|contains|all: - :\Users\ - \Contacts\ - ParentImage|contains|all: - :\Users\ - \Pictures\ filter_main_msu: CommandLine|contains: .msu condition: selection_img and 1 of selection_paths_* and not 1 of filter_main_* falsepositives: - Unknown level: high