One policy to rule them all

This report examines how adversaries can abuse Windows Group Policy Objects to distribute malware and ransomware, establish domain-wide persistence, and escalate privileges; it explains GPO internals (GPC/GPT and attributes), demonstrates abuse techniques and tools (SharpGPOAbuse, GPOddity), and provides practical detection rules (Event 5136, CSE GUIDs), scripts and monitoring approaches (Group3r, SharpHound, GCNet) for Compromise Assessment and MDR.