The Gentlemen RaaS GPO Abuse for Ransomware Distribution via PowerShell
Detects malicious use of PowerShell cmdlets to modify Group Policy Objects (GPOs) for ransomware distribution. The rule monitors for execution of GPO management cmdlets in conjunction with specific ransomware indicators, such as disabling Windows Defender real-time monitoring, modifying GPO machine extension names, or targeting SYSVOL/NETLOGON network shares.
Sigma
