Suspicious GrpConv Execution

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

Detects the suspicious execution of 'grpconv.exe' with the '-o' flag, which can be used to convert Windows 3.x .grp files or for persistence purposes by malicious software or actors. This command-line usage is uncommon in legitimate environments and may indicate an attempt to establish persistence or escalate privileges.