GPO Modified for Privilege Assignment
Detects when a Group Policy Object (GPO) is modified to include Client-Side Extensions (CSEs) for managing local group memberships or user rights assignments. While this can be a legitimate administrative action, attackers can abuse this capability to escalate privileges by adding accounts to sensitive local groups (e.g., Administrators) or granting powerful user rights. This alert serves as an early warning to investigate the specific changes made within the GPO.
SentinelOne
