Ransomware Series: Gentlemen Ransomware GPO-Based Lateral Movement via deploy_gp

Ibrahim Saud@tektrix

•updated Sep 25, 2026•1•0•3

Detects lateral movement activities associated with The Gentlemen ransomware group. The rule monitors for the execution of PowerShell scripts named 'deploy_gpo.ps1' from the %TEMP% directory, PowerShell interactions with the NETLOGON share for malware distribution, creation of ScheduledTasks.xml via PowerShell (a common GPO manipulation technique), and the subsequent enforcement of policy changes using 'gpupdate /force' invoked by scripting engines.