Modify Group Policy Settings - ScriptBlockLogging (b7216a7d-687e-4c8d-82b1-3080b2ad961f)

Detect malicious GPO modifications can be used to implement many other malicious behaviors.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Group Policy Modification - T1484.001 (5d2be8b9-d24c-4e98-83bf-2f5f79477163)	Attack Pattern	Modify Group Policy Settings - ScriptBlockLogging (b7216a7d-687e-4c8d-82b1-3080b2ad961f)	Sigma-Rules	1
Group Policy Modification - T1484.001 (5d2be8b9-d24c-4e98-83bf-2f5f79477163)	Attack Pattern	Domain or Tenant Policy Modification - T1484 (ebb42bbe-62d7-47d7-a55f-3b08b61d792d)	Attack Pattern	2