Windows Default Domain GPO Modification

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may modify these default GPOs to deploy malicious configurations across the domain.