Suspicious GPO Discovery With Get-GPO

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•17

This rule detects the execution of the PowerShell cmdlet 'Get-GPO'. This cmdlet is used to retrieve information about Group Policy Objects (GPOs) in a domain. Adversaries may use this for discovery purposes to understand the domain's policy configurations, which can aid in identifying potential privilege escalation paths or misconfigurations.