Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may modify these default GPOs to deploy malicious configurations across the domain.

Read More

Detects the use of the Group Policy Management Editor (GPME) to modify Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may leverage GPME to make stealthy changes in these default GPOs to deploy malicious GPOs configurations across the domain without raising suspicion.

Read More

Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins.

Read More

Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.

Read More

Detect malicious GPO modifications can be used to implement many other malicious behaviors.

Read More

Detect malicious GPO modifications can be used to implement many other malicious behaviors.

Read More