GPO logon script (gpscript.exe) execution followed by domain-wide .SINOBI ransomware encryption
This rule detects potential ransomware activity by correlating the execution of 'gpscript.exe', which is used to process Group Policy Object (GPO) logon scripts, with subsequent mass file encryption events involving files with the '.SINOBI' extension on the same host within a one-hour window. The rule specifically flags instances where at least five files are encrypted, indicating a high likelihood of a domain-wide ransomware deployment delivered via malicious GPO modification.
Microsoft Sentinel (KQL)
