Detectionmediumexperimental

Windows Default Domain GPO Modification

Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may modify these default GPOs to deploy malicious configurations across the domain.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Swachchhanda Shrawan Poudel (Nextron Systems)Created Sat Nov 22e5ac86dd-2da1-454b-be74-05d26c769d7dwindows

Log Source

Windowssecurity

ProductWindows← raw: windows

Servicesecurity← raw: security

Definition

Enable 'Audit Directory Service Changes' in the Default Domain Controllers Policy under: Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> Audit Policies -> DS Access -> Audit Directory Service Changes (Success). Additionally, proper SACL needs to be configured on the 'CN=Policies,CN=System,DC=<domain>,DC=<tld>' container in Active Directory to capture changes to Group Policy Objects.

Detection Logic

detection:
    selection:
        EventID: 5136
        ObjectClass: 'groupPolicyContainer'
        ObjectDN|startswith:
            - 'CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM' # Default Domain Policy
            - 'CN={6AC1786C-016F-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM' # Default Domain Controllers Policy
    condition: selection

False Positives

Legitimate modifications to Default Domain or Default Domain Controllers GPOs

References

MITRE ATT&CK

Tactics

TA0005 · Defense Evasion TA0004 · Privilege Escalation

Sub-techniques

T1484.001 · Group Policy Modification

Related Rules

SimilarDetectionmedium

Windows Default Domain GPO Modification via GPME

Detects the use of the Group Policy Management Editor (GPME) to modify Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may leverage GPME to make stealthy changes in these default GPOs to deploy malicious GPOs configurations across the domain without raising suspicion.

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

e5ac86dd-2da1-454b-be74-05d26c769d7d

Status

experimental

Level

medium

Type

Detection

Created

Sat Nov 22

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Path

rules/windows/builtin/security/win_security_default_domain_gpo_modification.yml

Raw Tags

attack.defense-evasionattack.privilege-escalationattack.t1484.001

View on GitHub