Windows Group Policy Object Created

The analytic detects the creation of a new Group Policy Object (GPO) by leveraging Windows Event IDs 5136 and 5137. These directory service change events indicate when a new GPO is created. Monitoring GPO creation is critical because adversaries can exploit GPOs to escalate privileges or deploy malware across an Active Directory network. Malicious GPO creation could allow attackers to control system configurations, deploy ransomware, or propagate malware, leading to widespread compromise and significant operational disruption.