| elastic |
Scheduled Task Execution at Scale via GPO |
production |
2026-10-06 |
| elastic |
Startup/Logon Script added to Group Policy Object |
production |
2026-10-06 |
| splunk |
Windows AD GPO New CSE Addition |
production |
2026-09-22 |
| elastic |
Creation or Modification of a new GPO Scheduled Task or Service |
production |
2026-09-18 |
| elastic |
Group Policy Abuse for Privilege Addition |
production |
2026-09-18 |
| splunk |
Windows Admon Group Policy Object Created |
production |
2026-05-13 |
| splunk |
Windows AD GPO Deleted |
production |
2026-05-13 |
| splunk |
Windows AD GPO Disabled |
production |
2026-05-13 |
| splunk |
Windows Admon Default Group Policy Object Modified |
production |
2026-05-13 |
| splunk |
Windows Default Group Policy Object Modified |
production |
2026-05-13 |
| splunk |
Windows Default Group Policy Object Modified with GPME |
production |
2026-05-13 |
| splunk |
Windows Group Policy Object Created |
production |
2026-05-13 |
| splunk |
Windows Scheduled Task Created in a Group Policy Object |
production |
2026-05-13 |
| sigma |
Windows Default Domain GPO Modification |
experimental |
2025-11-22 |
| sigma |
Windows Default Domain GPO Modification via GPME |
experimental |
2025-11-22 |
| sigma |
Startup/Logon Script Added to Group Policy Object |
test |
2024-09-06 |
| sigma |
Group Policy Abuse for Privilege Addition |
test |
2024-09-04 |
| sigma |
Modify Group Policy Settings |
test |
2022-08-19 |
| sigma |
Modify Group Policy Settings - ScriptBlockLogging |
test |
2022-08-19 |