Executive Summary
Microsoft Defender Security Research Team reported on a high-stakes incident involving a large educational institution where an attacker attempted to use Group Policy Objects (GPOs) as a force multiplier for ransomware. The attacker compromised a Domain Admin account and performed extensive reconnaissance and credential harvesting (Kerberoasting and NTDS dumping) before attempting to distribute ransomware across over 2,000 devices.
The threat actor's strategy involved a two-stage GPO abuse: first, creating a policy to disable Defender’s behavioral and real-time protections, and second, using a GPO to create scheduled tasks that pulled ransomware payloads (run.bat, run.exe, run.dll) from the SYSVOL share. This 'self-service' distribution model was largely neutralized by 'predictive shielding' and GPO hardening, which temporarily paused GPO propagation, protecting approximately 97% of targeted devices and preventing any encryption via the GPO vector.