StrikeShark SharpGPOAbuse GPO Modification for Lateral Movement

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects the execution of SharpGPOAbuse or usage of its associated command-line arguments. This tool is frequently used by attackers to modify Group Policy Objects (GPOs) in an Active Directory environment to achieve privilege escalation or persistent access.