Windows: Copying Executable or DLL Files into Default GPO Policies Folder

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1036.005Match Legitimate Resource Name or Location
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies file creation events where the target path includes the default GPO storage folder GUID and the file name ends with .exe or .dll. Attackers may stage malicious executables or libraries in GPO-related locations to increase the chance of later execution via policy application. It relies on Windows file event telemetry that provides the created/target filename path and extension.

Reporting behind it

Related detections9 linkedT1036.005 — drag to rearrange

Suspicious ALPHA SPIDER Rclone Exfiltration Tool Masquerading as System Binary (via process_creation)

Suspicious Axios NPM macOS Persistence Masquerading as Apple Service

Malicious Spoolsv Process Masquerading From Non-System Path (via process_creation)

Suspicious svchost.exe Execution From AppData Roaming Directory

Malicious StyleSmuggler (CVE-2026-75650) Post-Exploitation Implant Process (via process_creation)

Malicious WezRat Persistence via Chrome Updater Run Key

Malicious ValleyRAT RuntimeBroker Masquerade in RunTime Directory

Suspicious Execution of spools.exe from Public Directory

Malicious Fake Fortinet Patch Infostealer Execution (via process_creation)

Windows: Copying Executable or DLL Files into Default GPO Policies Folder

Pivot detection · T1036.005 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-copied-suspicious-exe-dll-files-into-default-gpo-storage-path-5f87308a

title: "Windows: Copying Executable or DLL Files into Default GPO Policies Folder"
id: 21407e48-16da-4a50-b169-1e65004e852f
status: test
description: This rule identifies file creation events where the target path includes the default GPO storage folder GUID and the file name ends with .exe or .dll. Attackers may stage malicious executables or libraries in GPO-related locations to increase the chance of later execution via policy application. It relies on Windows file event telemetry that provides the created/target filename path and extension.
references:
  - https://redcanary.com/blog/intelligence-insights-november-2021/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_default_gpo_dir_write.yml
author: elhoim, Huntrule Team
date: 2022-04-28
tags:
  - attack.stealth
  - attack.t1036.005
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains: \Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\
    TargetFilename|endswith:
      - .dll
      - .exe
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 5f87308a-0a5b-4623-ae15-d8fa1809bc60
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL