The Gentlemen RaaS GPO Abuse: deploy_gpo.ps1 and Forced Policy Propagation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects potentially malicious activities related to the manipulation of Group Policy Objects (GPOs) within an Active Directory environment. It identifies the execution of scripts or processes that create, modify, or force GPO updates (e.g., using 'gpupdate /force'), the deployment of suspicious GPO-related files like 'deploy_gpo.ps1', the manual modification of 'ScheduledTasks.xml' within the SYSVOL directory, and the use of PowerShell to disable real-time monitoring via GPO configuration changes.