StrikeShark SharpGPOAbuse GPO Modification for Privilege Escalation

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•7

Detects the execution of SharpGPOAbuse for malicious Group Policy Object (GPO) manipulation, specifically identifying characteristic command-line arguments used for task creation and modification. The rule also monitors for subsequent forced GPO updates via net.exe or net1.exe, often associated with post-exploitation activities in the StrikeShark campaign.