Storm 2603 GPO Modification For Defense Evasion
Detects PowerShell being used to modify Group Policy Objects (GPOs) to disable Windows Defender security features. This technique is used by threat actors like Storm-2603 for defense evasion.
YARA-L
Detects PowerShell being used to modify Group Policy Objects (GPOs) to disable Windows Defender security features. This technique is used by threat actors like Storm-2603 for defense evasion.
Already have an account?