Group Policy Discovery via gpresult, PowerShell, or ldifde

Shadows VMB@Vemorian_Mort

•updated 2 days ago•2•0•5

Detects the execution of tools and commands commonly used to enumerate Group Policy Objects (GPOs) within an environment, such as gpresult.exe with specific flags, PowerShell scripts querying GPO modules, or ldifde.exe checking group policy containers.