Group Policy Setting Modification via PowerShell Script Block Logging
Detects attempts to modify Group Policy settings related to system behavior or security features by analyzing PowerShell script block logs. This rule specifically looks for modifications to registry paths associated with Group Policy settings, such as refresh times or SmartScreen configurations, which could indicate an adversary attempting to establish persistence, evade defenses, or escalate privileges.
Sigma
