Suspicious GPO Discovery With Get-GPO — Detection Rule

Detect use of Get-GPO to get one GPO or all the GPOs in a domain.

Read the full analysis on IntelFusions