PAYLOAD Ransomware GPO Hijack: Multi-Source IOC Hunt
This rule monitors for a variety of indicators associated with malicious activity, including connections to known malicious IP addresses, the presence of specific malicious file hashes or filenames, modifications to Windows system policies (specifically Legal Notice configuration), and changes to Active Directory Group Policy Objects using specified GUIDs.
Microsoft Sentinel (KQL)
