Identifier / Programs / Windows

gpscript.exe

Group Policy Script Application file version info (xCyclopedia)

LOLBAS Execute 1 Sigma rule name it 1 ATT&CK technique 2 documented commands 16 known copies with hashes

How gpscript.exe is abused

documented by LOLBAS

Execute T1218 System Binary Proxy Execution

-logon

Execute T1218 System Binary Proxy Execution

-startup

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for gpscript.exe.

2 documented commands

from LOLBAS, each read by the identifier

Execute T1218 System Binary Proxy Execution Administrator privileges

Executes logon scripts configured in Group Policy.

Gpscript /logon

Identify

Execute T1218 System Binary Proxy Execution Administrator privileges

Executes startup scripts configured in Group Policy

Gpscript /startup

Identify

None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for gpscript.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for gpscript.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumGpscript Executionfrack113

T1218System Binary Proxy Execution

Is it the real gpscript.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionGroup Policy Script Application

16 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\gpscript.exe · signed by Microsoft Windows

10b96283c695170f30cfc85e7162d9711f691d721f2556f85aa6d62049b80a9f

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\gpscript.exe · signed by Microsoft Windows

94289fd0ff0691637042ae25a6f45569b4fe36c5651672e477d198351c7be673

10.0.19041.572 (WinBuild.160101.0800) · C:\Windows\system32\gpscript.exe · signed by Microsoft Windows

bb008deed1241ead9f245661d2cd629d02031433b614cdc2cd7b1291a753a6a7

10.0.19041.572 (WinBuild.160101.0800) · C:\Windows\SysWOW64\gpscript.exe · signed by Microsoft Windows

e2434cd5c049db2976702490c5e34c0134a9f158fa76020c62de4a6dc4aaa25f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\gpscript.exe · signed by Microsoft Windows

10da9175bc408cb270b4cf24167bab915e34bd5abb3d2bce3ec9d3e68a329622

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\gpscript.exe · signed by Microsoft Windows

6d01f0fba4f2df370dff5c91728c407df8e364470e1d6776bf25c6248b938212

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\gpscript.exe · signed by Microsoft Windows

b12d639945ec97872836beaf93302e1b70ac9cdbafff20e886a7973aa840cb2c

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\gpscript.exe · signed by Microsoft Windows

fc2bba5bf5687a7ad45c158b9002d7563384e5149bd623adc88d4482d0782ae2

10.0.17763.1518 (WinBuild.160101.0800) · C:\Windows\system32\gpscript.exe · signed by Microsoft Windows

8beec3990687ecbddf7a7e2a4278f8c220314688f914c5d87280a55a97fb6dfa

10.0.17763.1518 (WinBuild.160101.0800) · C:\Windows\SysWOW64\gpscript.exe · signed by Microsoft Windows

ba34765365fe1d6ce2864cabbc3a8864782c38722f7b24b7a0325e6a144868ee

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\gpscript.exe · signed by Microsoft Windows

4d6b2e5242862760cb9d4b848df760cd3a5a011dd59a5c633ec966d32d1d6ea2

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\gpscript.exe · signed by Microsoft Windows

cc8fdb26570f698f614f505809d1adb0c1f470d34823c4f729bad0aea3a73925

10.0.14393.2457 (rs1_release_inmarket.180822-1743) · C:\Windows\system32\gpscript.exe · signed by Microsoft Windows

57b307144f8ed485dfc4519431131a722db2e64ff5c8a35e7f1b59663ff1738d

10.0.14393.2457 (rs1_release_inmarket.180822-1743) · C:\Windows\SysWOW64\gpscript.exe · signed by Microsoft Windows

d57e63c93a8713e342754c911c7053a08bf4b100049a1730acfb1f696062a35b

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\gpscript.exe · not signed

d676d4f5f949fed314d4a06b1df0d47d492c052d83ecbf3e07d8fa9ff34c1dc3

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\gpscript.exe · not signed

ff6a8dce772ee184086311e08588a4d8bc1202996b0e315bb83156025d54b526

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.