indicatorfilename
deploy_gpo.ps1
- First seen
- 2026-08-08
- Last seen
- 2026-08-08
- Sightings
- 1
Posts referencing this indicator
- The Gentlemen are knocking: сustom backdoors and evolving tactics
PowerShell script generated by the ransomware in %temp% when the --gpo parameter is used. Copies ransomware to NETLOGON share, creates fake GPO to disable Defender, and forces group policy update across all domain computers.