Startup/Logon Script Added to Group Policy Object (123e4e6d-b123-48f8-b261-7214938acaf0)

Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Group Policy Modification - T1484.001 (5d2be8b9-d24c-4e98-83bf-2f5f79477163)	Attack Pattern	Startup/Logon Script Added to Group Policy Object (123e4e6d-b123-48f8-b261-7214938acaf0)	Sigma-Rules	1
Boot or Logon Autostart Execution - T1547 (1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf)	Attack Pattern	Startup/Logon Script Added to Group Policy Object (123e4e6d-b123-48f8-b261-7214938acaf0)	Sigma-Rules	1
Group Policy Modification - T1484.001 (5d2be8b9-d24c-4e98-83bf-2f5f79477163)	Attack Pattern	Domain or Tenant Policy Modification - T1484 (ebb42bbe-62d7-47d7-a55f-3b08b61d792d)	Attack Pattern	2