Malware

SharpGPOAbuse

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1053.005Scheduled TaskEvidence1

let’s create a user-defined scheduler task that will run under the account labdomain.local\admin... during GPO modification, a new task is first added to the GPT on SYSVOL as an XML file.

Persistence

5 techniques

T1037Boot or Logon Initialization ScriptsEvidence1

group policies can also be used to covertly gain a foothold in a domain... Run tasks on behalf of the system and/or user... Detecting the addition of new autorun scripts through GPOs

T1053.005Scheduled TaskEvidence1

let’s create a user-defined scheduler task that will run under the account labdomain.local\admin... during GPO modification, a new task is first added to the GPT on SYSVOL as an XML file.

T1098.007Additional Local or Domain GroupsEvidence1

group policies can also be used to covertly gain a foothold in a domain... Create new local users/administrators

T1136.001Local AccountEvidence1

group policies can also be used to covertly gain a foothold in a domain... Create new local users/administrators

T1547Boot or Logon Autostart ExecutionEvidence1

Persistence T1547 – Boot or Logon AutoStart Execution The threat actor used SharpGPOAbuse to setup malicious script configured to run during startup or user logon.

Privilege Escalation

5 techniques

T1037Boot or Logon Initialization ScriptsEvidence1

group policies can also be used to covertly gain a foothold in a domain... Run tasks on behalf of the system and/or user... Detecting the addition of new autorun scripts through GPOs

T1053.005Scheduled TaskEvidence1

let’s create a user-defined scheduler task that will run under the account labdomain.local\admin... during GPO modification, a new task is first added to the GPT on SYSVOL as an XML file.

T1098.007Additional Local or Domain GroupsEvidence1

group policies can also be used to covertly gain a foothold in a domain... Create new local users/administrators

T1484.001Group Policy ModificationEvidence5

T1484.001 – Domain or Tenant Policy Modification: Group Policy Modification The threat actor used SharpGPOAbuse to modify the GPO and setup malicious script configured to run during startup or user logon on the computers within the network.

T1547Boot or Logon Autostart ExecutionEvidence1

Persistence T1547 – Boot or Logon AutoStart Execution The threat actor used SharpGPOAbuse to setup malicious script configured to run during startup or user logon.

Defense Impairment

1 technique

T1484.001Group Policy ModificationEvidence5

Discovery

2 techniques

T1033System Owner/User DiscoveryEvidence1

User and group information : query user nslookup quser

T1087Account DiscoveryEvidence1

powershell "Get-ADGroupMember -Identity " " -Recursive | Select-Object Name, ObjectClass" ... powershell -exec bypass -c " Get - ADUser - Filter * - Prop * | select sAMAccountName

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

Appendix C: “Lateral Movement T1021 Remote Services Propagated the ransomware using compromised AD credentials and GPOs.”

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyber security newsNews

Jan 6, 2026

Active Directory Attack Kill Chain Checklist & Tools List- 2026

SharpGPOAbuse is a tool for abusing insecure Group Policy Object (GPO) permissions to escalate privileges or maintain persistence in Active Directory environments.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

SharpGPOAbuse

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1053.005Scheduled TaskEvidence1

let’s create a user-defined scheduler task that will run under the account labdomain.local\admin... during GPO modification, a new task is first added to the GPT on SYSVOL as an XML file.

Persistence

5 techniques

T1037Boot or Logon Initialization ScriptsEvidence1

group policies can also be used to covertly gain a foothold in a domain... Run tasks on behalf of the system and/or user... Detecting the addition of new autorun scripts through GPOs

T1053.005Scheduled TaskEvidence1

let’s create a user-defined scheduler task that will run under the account labdomain.local\admin... during GPO modification, a new task is first added to the GPT on SYSVOL as an XML file.

T1098.007Additional Local or Domain GroupsEvidence1

group policies can also be used to covertly gain a foothold in a domain... Create new local users/administrators

T1136.001Local AccountEvidence1

group policies can also be used to covertly gain a foothold in a domain... Create new local users/administrators

T1547Boot or Logon Autostart ExecutionEvidence1

Persistence T1547 – Boot or Logon AutoStart Execution The threat actor used SharpGPOAbuse to setup malicious script configured to run during startup or user logon.

Privilege Escalation

5 techniques

T1037Boot or Logon Initialization ScriptsEvidence1

group policies can also be used to covertly gain a foothold in a domain... Run tasks on behalf of the system and/or user... Detecting the addition of new autorun scripts through GPOs

T1053.005Scheduled TaskEvidence1

let’s create a user-defined scheduler task that will run under the account labdomain.local\admin... during GPO modification, a new task is first added to the GPT on SYSVOL as an XML file.

T1098.007Additional Local or Domain GroupsEvidence1

group policies can also be used to covertly gain a foothold in a domain... Create new local users/administrators

T1484.001Group Policy ModificationEvidence5

T1547Boot or Logon Autostart ExecutionEvidence1

Persistence T1547 – Boot or Logon AutoStart Execution The threat actor used SharpGPOAbuse to setup malicious script configured to run during startup or user logon.

Defense Impairment

1 technique

T1484.001Group Policy ModificationEvidence5

Discovery

2 techniques

T1033System Owner/User DiscoveryEvidence1

User and group information : query user nslookup quser

T1087Account DiscoveryEvidence1

powershell "Get-ADGroupMember -Identity " " -Recursive | Select-Object Name, ObjectClass" ... powershell -exec bypass -c " Get - ADUser - Filter * - Prop * | select sAMAccountName

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

Appendix C: “Lateral Movement T1021 Remote Services Propagated the ransomware using compromised AD credentials and GPOs.”

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyber security newsNews

Jan 6, 2026

Active Directory Attack Kill Chain Checklist & Tools List- 2026

SharpGPOAbuse is a tool for abusing insecure Group Policy Object (GPO) permissions to escalate privileges or maintain persistence in Active Directory environments.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.