The Gentlemen RaaS GPO-based Ransomware Distribution via deploy_gpo.ps1
Detects potentially unauthorized or malicious Group Policy Object (GPO) modifications and deployment activities. This includes the creation or modification of GPO files on domain controllers (SYSVOL/NETLOGON shares), the use of specific PowerShell scripts associated with GPO deployment, execution of forced group policy updates, and attempts to disable real-time security monitoring via GPO context.
Splunk (SPL)
