Skip to content

Hide Navigation Hide TOC

Suspicious Files in Default GPO Folder (5f87308a-0a5b-4623-ae15-d8fa1809bc60)

Detects the creation of copy of suspicious files (EXE/DLL) to the default GPO storage folder

Cluster A Galaxy A Cluster B Galaxy B Level
Suspicious Files in Default GPO Folder (5f87308a-0a5b-4623-ae15-d8fa1809bc60) Sigma-Rules Match Legitimate Name or Location - T1036.005 (1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2) Attack Pattern 1
Masquerading - T1036 (42e8de7b-37b2-4258-905a-6897815e58e0) Attack Pattern Match Legitimate Name or Location - T1036.005 (1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2) Attack Pattern 2