Group Policy Object Modification via SMB

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects attempts to modify Group Policy Objects (GPOs) over Server Message Block (SMB) by looking for HTTP PUT requests containing '\SYSVOL\' and '\Policies\' in the URI. This activity can indicate an adversary attempting to escalate privileges or establish persistence within an Active Directory domain.