Executable Dropped to SYSVOL/GPO Path With GPO Modification (Tuned)

ills3c Intel&Coffee@Ills3C

•updated 7 days ago•0•0•0

Detects Play-style lateral movement via Group Policy: an executable (.exe/.dll) written to a SYSVOL/GPO path by the same non-machine account that modified a GPO in the same 30-minute window. Attackers use this to push ransomware or Cobalt Strike/SystemBC payloads domain-wide.