StrikeShark SharpGPOAbuse GPO Modification for Persistence or Privilege Escalation

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•7

This rule detects potentially malicious activity related to Group Policy Object (GPO) manipulation, including the execution of the SharpGPOAbuse tool and suspicious PowerShell commands intended to modify GPOs for persistence or privilege escalation, such as adding local administrators, creating immediate tasks, or applying domain-level policies.