StrikeShark SharpGPOAbuse GPO Abuse and Rapid AD Group Enumeration

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•2

Detects the use of the SharpGPOAbuse tool, typically used for modifying Group Policy Objects for persistence or privilege escalation, in conjunction with rapid Active Directory group enumeration (using net.exe or net1.exe) on the same host within a 5-minute window. This behavior is highly indicative of an adversary performing post-exploitation reconnaissance and privilege escalation activities.