TOKYOCORE GPO Startup Script Injection for Domain-Wide Propagation
Detects unauthorized file write operations to Group Policy Object (GPO) startup script paths or suspicious GPO configuration files. This behavior is associated with the TOKYOCORE ransomware, which uses GPO modification as a mechanism for persistence and domain-wide propagation of malicious payloads via startup scripts.
Cortex XDR
