Persistence and Execution at Scale via GPO Scheduled Task
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Object Changed or Network Share Accessed" AND (DISPLAYNAME = "gPCMachineExtensionNames,gPCUserExtensionNames" AND SHAREPATH contains "CAB54552-DEEA-4691-817E-ED4A4D1AFC72,AADCED64-746C-4633-A97C-D61349046527") OR (SHARENAME endswith "\SYSVOL" AND RELATIVETARGETNAME endswith "ScheduledTasks.xml" AND ACCESSLIST contains "WriteData,%%4417") select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.DOMAIN,Action1.TARGETDOMAIN,Action1.TARGETMACHINE,Action1.RELATIVETARGETNAME,Action1.SHARENAME,Action1.SHAREPATH,Action1.OBJECTTYPE,Action1.OBJECTNAME,Action1.CHANGES
Detection
Execution Mode
realtime
Log Sources
Active Directory
Author
Samir Bousseaden
