Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

Modify Group Policy Settings - ScriptBlockLogging

Detect malicious GPO modifications can be used to implement many other malicious behaviors.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
François HubautCreated Fri Aug 19b7216a7d-687e-4c8d-82b1-3080b2ad961fwindows
Log Source
WindowsPowerShell Script
ProductWindows← raw: windows
CategoryPowerShell Script← raw: ps_script

Definition

Requirements: Script Block Logging must be enabled

Detection Logic
Detection Logic2 selectors
detection:
    selection_path:
        ScriptBlockText|contains: \SOFTWARE\Policies\Microsoft\Windows\System
    selection_key:
        ScriptBlockText|contains:
            - GroupPolicyRefreshTimeDC
            - GroupPolicyRefreshTimeOffsetDC
            - GroupPolicyRefreshTime
            - GroupPolicyRefreshTimeOffset
            - EnableSmartScreen
            - ShellSmartScreenLevel
    condition: all of selection_*
False Positives

Legitimate use

References
1
Resolving title…
github.com
MITRE ATT&CK
Related Rules
SimilarDetectionmedium

Modify Group Policy Settings

Detect malicious GPO modifications can be used to implement many other malicious behaviors.

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata
Rule ID
b7216a7d-687e-4c8d-82b1-3080b2ad961f
Status
test
Level
medium
Type
Detection
Created
Fri Aug 19
Author
François Hubaut
Path
rules/windows/powershell/powershell_script/posh_ps_modify_group_policy_settings.yml
Raw Tags
attack.defense-evasionattack.privilege-escalationattack.t1484.001
View on GitHub