StrikeShark SharpGPOAbuse GPO Modification for Persistence and Lateral Movement

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects the execution of the SharpGPOAbuse utility or the use of its specific command-line arguments intended for manipulating Active Directory Group Policy Objects (GPOs) to achieve privilege escalation or persistence.