Suspicious SYSVOL Domain Group Policy Access

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•16

Detects suspicious access to Domain Group Policies stored in the SYSVOL share. This rule specifically looks for command-line activity that includes both '\SYSVOL\' and '\policies\', indicating an attempt to interact with Group Policy objects.