The Gentlemen RaaS: GPO-Based Ransomware Distribution via deploy_gpo.ps1

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects suspicious command-line activity related to the abuse of Group Policy Objects, including unauthorized GPO creation/linking, modification of GPO registry settings, forced GPO updates, and the staging of files or scheduled tasks within NETLOGON or SYSVOL directories, commonly associated with ransomware deployment or domain persistence.