Used by group policy to process scripts
Gpscript /startup
Executes startup scripts configured in Group Policy
Add local group policy logon script to execute file and hide from defensive counter measures
C:\Windows\System32\gpscript.exe, C:\Windows\SysWOW64\gpscript.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_gpscript.yml, IOC: Scripts added in local group policy, IOC: Execution of Gpscript.exe after logon
Oddvar Moe (@oddvarmoe)