The Gentlemen RaaS: GPO Modification for Mass Ransomware Distribution via PowerShell and gpupdate /force

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects suspicious modifications to Group Policy Objects (GPOs) using PowerShell cmdlets, including references to sensitive paths like SYSVOL/NETLOGON or suspicious script files, as well as the execution of 'gpupdate /force' from non-standard shell processes. These behaviors are often indicative of GPO abuse for persistence, lateral movement, or defense evasion.