Remote Group Policy Discovery via SMB

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects attempts to discover Group Policy information remotely over Server Message Block (SMB). It specifically looks for network traffic on port 445 (SMB) containing the strings "SYSVOL" and "GroupPolicy" (case-insensitive) in the same flow, indicating a potential query for Group Policy objects.