Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

LockBit 2.0 – New Group Policy Object Followed by Mass Scheduled-Task Deployment

Lockbit2 Lateral Movement Sentinel
MITRE ATT&CK
Group Policy Modification
Data Source
SecurityEvent
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group profile (lockbit2); public LockBit 2.0 GPO-deployment reporting
What This Detects
LockBit 2.0's signature feature is automated, domain-wide encryption pushed via a newly created/modified GPO that deploys a scheduled task to every joined machine. Flags a GPO change event (5136/5137) followed within an hour by scheduled-task creation (4698) on many hosts.
Query
let gpoChange = SecurityEvent
| where TimeGenerated > ago(1d)
| where EventID in (5136, 5137) and ObjectClass == "groupPolicyContainer"
| project GpoChangeTime = TimeGenerated, SubjectAccount, ObjectDN;
let taskCreate = SecurityEvent
| where TimeGenerated > ago(1d)
| where EventID == 4698
| project TaskCreateTime = TimeGenerated, Computer, TaskName = EventData;
gpoChange
| join kind=inner taskCreate on $left.SubjectAccount == $right.Computer
| where TaskCreateTime - GpoChangeTime between (0min .. 1h)
| summarize AffectedHosts = dcount(Computer), Tasks = make_set(TaskName) by SubjectAccount, bin(GpoChangeTime, 1h)
| where AffectedHosts > 5

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.