Ransomware GPO Abuse - Script/Startup Policy Modification via Non-Admin Account

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule detects modifications to Group Policy Objects (GPOs) that involve sensitive attributes such as logon scripts, startup/shutdown scripts, or file system paths, particularly when performed by service accounts or non-administrator users. This activity is a common indicator of persistence mechanisms or lateral movement via GPO abuse.