Suspicious Executable or DLL Creation in Default GPO Folder

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

This rule detects the creation of executable files (.exe) or dynamic link libraries (.dll) within the default Group Policy Object (GPO) storage folder. Adversaries may place malicious files in this location to leverage Group Policy for persistence, privilege escalation, or to distribute malware across a domain. The specific folder path targeted is '\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\' which corresponds to the Default Domain Policy GPO.