Uncommon Process Access to Sysvol Policies Share

SigmaHQ Detections@sigmaHQ

•updated Nov 1, 2024•0•27

Detects file access requests to the Windows Sysvol Policies Share by processes that are not commonly expected to interact with these files. This could indicate an adversary attempting to discover or exploit Group Policy Preferences for credential access or other malicious purposes.