GPO creation/modification matching PAYLOAD ransomware GPO tradecraft
Detects modifications to Group Policy Objects (GPOs) or GPO links in Active Directory, specifically targeting known malicious GPO identifiers, GPO payloads, or changes to policy versioning and linking that indicate unauthorized configuration changes for persistence or privilege escalation.
Microsoft Sentinel (KQL)
