Startup/Logon Script Added to Group Policy Object

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•37

Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects. This can be used by adversaries for persistence, privilege escalation, or defense evasion.