What are the four types of script execution events in a Group Policy Object (GPO) that can be used for remote execution in a domain?
In a GPO, scripts can be configured to run during Startup, Shutdown, Logon, and Logoff events. Startup and Shutdown scripts are configured under Computer Configuration → Windows Settings → Scripts, while Logon and Logoff scripts are under User Configuration → Windows Settings → Scripts. This allows attackers to execute arbitrary scripts on target machines when specific events occur, as detailed in the article on [Domain Penetration - Remote Execution via Scripts in GPO](/news/domain-penetration-remote-execution-via-scripts-in-gpo).
Related article:
Domain Penetration - Remote Execution via Scripts in GPO