StrikeShark SharpGPOAbuse GPO Abuse for AD Persistence or Privilege Escalation
Detects the use of SharpGPOAbuse or common command-line arguments associated with GPO manipulation, such as creating immediate tasks or modifying domain object ACLs. Additionally, it monitors for suspicious execution of gpupdate.exe with the /force flag, specifically when initiated by unauthorized processes or non-Microsoft signed binaries.
SentinelOne
