Domain admin credential abuse to modify GPOs

Ibrahim Saud@tektrix

•updated Sep 22, 2026•1•0•5

This rule detects modifications to Group Policy Objects (GPOs) performed by accounts identified as domain administrator-equivalent (based on naming conventions) within 60 minutes of a successful logon from a device, potentially indicating GPO weaponization by an adversary using a compromised account.