SYSVOL Groups.xml File Read
This rule detects when the 'Groups.xml' file within the SYSVOL folder is read. This file can contain sensitive credential information, such as passwords for service accounts, if Group Policy Preferences (GPP) were used to deploy them. Attackers often target this file to extract credentials for privilege escalation or lateral movement.
Microsoft Sentinel (KQL)
