Startup/Logon Script Added to Group Policy Object — Detection Rule

Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.

Read the full analysis on IntelFusions