Gpresult Display Group Policy Information
Detects the use of the built-in Windows utility 'gpresult.exe' with specific command-line arguments ('/z' or '/v') to display detailed Resultant Set of Policy (RSoP) information. This activity can be indicative of an adversary performing discovery to understand the group policy configuration of a system or domain.
Sigma
