Access To Potentially Sensitive Sysvol Files By Uncommon Applications
Detects file access requests to potentially sensitive files hosted on the Windows Sysvol share by applications that are not commonly expected to access these files. This can indicate an attempt to gather credentials or configuration details from Group Policy Objects.
Sigma
