Detection rules › Elastic
Startup/Logon Script added to Group Policy Object
Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.
MITRE ATT&CK coverage
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Security-Auditing | 5136 | A directory service object was modified. |
| Security-Auditing | 5145 | A network share object was checked to see whether client can be granted desired access. |
Stages and Predicates
Stage 1: eql:any
winlog.event_data.AttributeLDAPDisplayName:"gPCMachineExtensionNames" and winlog.event_data.AttributeValue:"40B66650-4972-11D1-A7CA-0000F87571E3" and winlog.event_data.AttributeValue:"42B5FAAE-6536-11D2-AE5A-0000F87571E3"Stage 2: eql:any
winlog.event_data.AccessList:"%%4417" and winlog.event_data.RelativeTargetName:"*\\scripts.ini" and winlog.event_data.ShareName:"\\\\*\\SYSVOL"Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
winlog.event_data.AccessList | wildcard |
|
winlog.event_data.AttributeLDAPDisplayName | wildcard |
|
winlog.event_data.AttributeValue | wildcard |
|
winlog.event_data.RelativeTargetName | wildcard |
|
winlog.event_data.ShareName | wildcard |
|
Neighbors
Broader alternatives (more inclusive than this rule)
These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.
- Startup/Logon Script Added to Group Policy Object (drops 3 filters this rule applies)
Often fire together
Rules that target events appearing in the same incident timelines. They pattern-match on adjacent steps of the same TTP, so an alert from one is often paired with alerts from these. Useful for triage context and for assembling chained-detection rules.
- Potential Kerberos Coercion via DNS-Based SPN Spoofing
- Suspicious Remote Registry Access via SeBackupPrivilege
- Scheduled Task Execution at Scale via GPO
- Persistence and Execution at Scale via GPO Scheduled Task
- Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation
- Startup/Logon Script Added to Group Policy Object
- Windows AD Short Lived Server Object
- Windows Administrative Shares Accessed On Multiple Hosts
Share event IDs (chain-detection candidates)
Rules that observe the same Windows event-ID pairs as this one. If you're authoring a multi-stage / sequence rule that spans these events, these are the existing detections that already cover one or both endpoints.