Skip to content
Threat Feed

Tag

T1484.001

1 brief RSS
medium advisory

Active Directory Group Policy Deletion Detected

Detection of Active Directory Group Policy deletion using event ID 5136, indicating potential malicious activity or misconfiguration.

Splunk Enterprise +2 active-directory group-policy gpo deletion t1484.001
2r 2t