How do you detect GPO-based ransomware deployment?

Alert on the policy change, not the effect. Enable Directory Service Changes auditing on domain controllers and flag new groupPolicyContainer objects (event 5137) and gPLink modifications on the domain root or wide OUs (event 5136) made outside your change process. Add file-event detection for executables, scripts or ScheduledTasks.xml written under SYSVOL Policies. Because clients refresh policy on a schedule, catching the change gives you time to unlink the GPO before it applies to every machine.

Detecting GPO-Based Mass Payload Deployment

Operators with domain admin often skip per-host tooling and push the payload through Group Policy: a new GPO with a startup script or an immediate scheduled task, linked to a wide OU. Policy refresh takes up to ninety minutes by default, which gives you a detection window if you alert on the change rather than the effect.

Signals at a Glance

Signal	Where	ATT&CK
New groupPolicyContainer object created (5137)	Domain controller Security log	T1484.001
gPLink attribute modified on a domain or wide OU (5136)	Domain controller Security log	T1484.001
Executable or script written under SYSVOL Policies	File audit, Sysmon 11	T1037.001
ScheduledTasks.xml or scripts.ini written to a GPO folder	File audit	T1053.005
Many hosts creating the same task or service after refresh	4698, 7045	T1570

Directory Change Events

Enable the Directory Service Changes audit subcategory on domain controllers. Then alert when a GPO is created or linked outside your change process, and especially when the actor is not a member of the group-policy administrators you expect:

// Sentinel (KQL) - GPO created or linked to a wide scope
SecurityEvent
| where EventID in (5136, 5137)
| where (EventID == 5137 and ObjectClass == "groupPolicyContainer")
     or (EventID == 5136 and AttributeLDAPDisplayName == "gPLink")
| project TimeGenerated, Computer, SubjectUserName, EventID, AttributeLDAPDisplayName, ObjectDN
| order by TimeGenerated desc
// tune/validate: field extraction differs by connector; allowlist your GPO change accounts

What the Policy Carries

The payload has to be staged where clients can read it. SYSVOL write events and policy file types reveal intent before any client applies the policy:

title: Executable or Script Written to GPO Policy Folder
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains|all:
      - '\SYSVOL\'
      - '\Policies\'
  ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.bat'
      - '.ps1'
      - '.vbs'
      - 'ScheduledTasks.xml'
  condition: selection and ext
level: high
# tune/validate: legitimate logon scripts and ADMX content will match; baseline first

Alert when a newly created GPO is linked within minutes, particularly to the domain root or a computers OU.
Restrict who can create and link GPOs, and require a ticket reference for each change.
If a rogue GPO is confirmed, unlink it first, then remove it; a deleted policy may already have applied.

Vetted sources

SigmaHQ Group Policy and SYSVOL rules, Elastic and Splunk ESCU analytics for GPO modification, and DFIR Report-style write-ups of GPO-based deployment. Whether auditing is enabled on SYSVOL and domain controllers is the first thing to verify in your own environment.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Directory Change Events

What the Policy Carries

Build Detections That Fire

Ransomware Precursor Detection

Detection Hub

Mass PsExec Deployment Detection

Time-to-Ransom Compression