Detectionmediumexperimental

Windows Default Domain GPO Modification via GPME

Detects the use of the Group Policy Management Editor (GPME) to modify Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may leverage GPME to make stealthy changes in these default GPOs to deploy malicious GPOs configurations across the domain without raising suspicion.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

TropChaudCreated Sat Nov 22dcff7e85-d01f-4eb5-badd-84e2e6be8294windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    # "C:\Windows\System32\gpme.msc" /s /gpobject:"LDAP://<REDACTED>/cn<REDACTED>,cnpolicies,cnsystem,DC<REDACTED>,DClocal"
    selection_mmc:
        - Image|endswith: '\mmc.exe'
        - OriginalFileName: 'MMC.exe'
    selection_gpme:
        CommandLine|contains|all:
            - 'gpme.msc'
            - 'gpobject:'
    selection_default_gpos:
        CommandLine|contains:
            - '31B2F340-016D-11D2-945F-00C04FB984F9' # Default Domain Policy GUID
            - '6AC1786C-016F-11D2-945F-00C04FB984F9' # Default Domain Controllers Policy GUID
    condition: all of selection_*

False Positives

Legitimate use of GPME to modify GPOs

References

MITRE ATT&CK

Tactics

TA0005 · Defense Evasion TA0004 · Privilege Escalation

Sub-techniques

T1484.001 · Group Policy Modification

Related Rules

SimilarDetectionmedium

Windows Default Domain GPO Modification

Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may modify these default GPOs to deploy malicious configurations across the domain.

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

dcff7e85-d01f-4eb5-badd-84e2e6be8294

Status

experimental

Level

medium

Type

Detection

Created

Sat Nov 22

Author

TropChaud

Path

rules/windows/process_creation/proc_creation_win_mmc_default_domain_gpo_modification_via_gpme.yml

Raw Tags

attack.defense-evasionattack.privilege-escalationattack.t1484.001

View on GitHub