Detect Group Policy Modification in Elastic Security
Adversaries may modify Group Policy Objects (GPOs) to subvert intended access controls across a Windows domain, typically to escalate privileges, disable security tools, or enable mass payload distribution. GPOs stored in SYSVOL control centralized user and computer settings across Active Directory environments. Malicious GPO modifications can deploy scheduled tasks, create accounts, grant dangerous privileges like SeEnableDelegationPrivilege, or push ransomware to every domain-joined machine simultaneously. LockBit 2.0/3.0 and Qilin ransomware modified GPOs to disable Windows Defender and propagate malware domain-wide. APT41 used GPO-deployed scheduled tasks for coordinated ransomware deployment. Indrik Spider (Evil Corp), Cinnamon Tempest, and Storm-0501 have all leveraged GPO modification for lateral movement and payload execution at scale. The Empire framework's New-GPOImmediateTask cmdlet and SharpGPOAbuse tool provide ready-made capabilities for GPO abuse by threat actors with sufficient AD permissions.
MITRE ATT&CK
- Sub-technique
- T1484.001 Group Policy Modification
- Canonical reference
- https://attack.mitre.org/techniques/T1484/001/
Elastic Detection Query
any where
(
/* Branch 1: AD Directory Service Audit Events for GPO Modification */
event.code in ("5136", "5137", "5138", "5141") and
event.provider == "Microsoft-Windows-Security-Auditing" and
(
winlog.event_data.ObjectClass : "groupPolicyContainer" or
winlog.event_data.ObjectDN : "*CN=Policies*CN=System*"
)
) or
(
/* Branch 2: SYSVOL Filesystem Changes via Sysmon File Create (Event 11) */
event.category == "file" and
event.type in ("creation", "change") and
file.path like~ "*sysvol*" and
file.name in~ (
"ScheduledTasks.xml", "GptTmpl.inf", "GPT.INI",
"Startup.xml", "Shutdown.xml", "Registry.xml",
"Services.xml", "Groups.xml", "Files.xml"
)
) or
(
/* Branch 3: PowerShell GPO Management Cmdlets and Known Attack Tools */
event.category == "process" and
process.name in~ ("powershell.exe", "pwsh.exe") and
process.command_line like~ (
"*New-GPOImmediateTask*", "*New-GPO *", "*Set-GPOLink*",
"*Import-GPO*", "*Set-GPPermissions*", "*SharpGPOAbuse*",
"*Invoke-GPOZaurr*", "*SeEnableDelegationPrivilege*",
"*GptTmpl.inf*", "*Get-GPPermissions*", "*New-GPLink*",
"*Set-GPRegistryValue*", "*New-GPPImmediateTask*"
)
)Detects MITRE T1484.001 Group Policy Modification across three telemetry sources: Windows Security audit events 5136/5137/5138/5141 for AD GPO object changes, Sysmon Event 11 file creation in SYSVOL for policy content modification, and PowerShell process events for GPO management cmdlets and known attack tools (SharpGPOAbuse, Invoke-GPOZaurr, Empire New-GPOImmediateTask). Covers LockBit/Qilin-style domain-wide ransomware propagation via GPO and privilege escalation via SeEnableDelegationPrivilege injection.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Group Policy administrators running GPMC (Group Policy Management Console) or using PowerShell RSAT tools during change windows — expect 5136/5137 events from authorized admin accounts during scheduled maintenance
- SCCM/Intune co-management scenarios where ConfigMgr writes policy files to SYSVOL paths as part of client policy refresh or compliance baseline deployment
- Automated domain hardening scripts (CIS benchmarks, DISA STIGs) that programmatically create or modify GPOs via PowerShell — Set-GPRegistryValue and Import-GPO are common in legitimate baseline deployment pipelines
- GPO backup and restore operations by domain admins using native GPMC backup functionality, which writes to SYSVOL and triggers 5136/5137 events with versionNumber and gPCFileSysPath attribute changes
- Security assessment tools like PingCastle, BloodHound, or Purple Knight that enumerate GPO permissions via Get-GPPermissions as read-only recon — these produce PowerShell matches without modifying GPOs
Other platforms for T1484.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Malicious Scheduled Task via GPO (New-GPOImmediateTask)
Expected signal: Security Event ID 5137 on Domain Controller: GPO container object created (ObjectClass=groupPolicyContainer). Security Event ID 5136 on DC: gPCMachineExtensionNames attribute added (indicating new machine policy CSE). Sysmon Event ID 11: File Create for ScheduledTasks.xml in SYSVOL path from PowerShell process. Security Event ID 5136: versionNumber attribute incremented on GPO object. PowerShell ScriptBlock Log (Event ID 4104) capturing New-GPO, New-GPLink, and file write operations.
- Test 2Modify GptTmpl.inf to Grant SeEnableDelegationPrivilege
Expected signal: Sysmon Event ID 11: File Create for GptTmpl.inf in SYSVOL path (\\DOMAIN\SYSVOL\DOMAIN\Policies\{GUID}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf). Security Event ID 5136 on DC: gPCMachineExtensionNames updated to include security extension GUID {827D319E-6EAC-11D2-A4EA-00C04F79F83A} (Security). versionNumber increment. PowerShell ScriptBlock Log Event ID 4104 capturing the file write and SYSVOL path construction.
- Test 3Enumerate GPO Permissions with PowerView (Recon Phase)
Expected signal: PowerShell ScriptBlock Log Event ID 4104: Get-GPPermissions cmdlet execution with -All parameter iterating across all GPOs. Sysmon Event ID 1: powershell.exe process creation with Get-GPPermissions and Get-GPO in command line. Active Directory query events may appear in Domain Controller logs for LDAP searches against CN=Policies.
- Test 4Deploy Ransomware Simulation via GPO Startup Script
Expected signal: Sysmon Event ID 11: File Create events for startup.bat and scripts.ini in SYSVOL path from powershell.exe. Security Event ID 5136 on DC: gPCMachineExtensionNames updated to include scripts CSE GUID {42B5FAAE-6536-11D2-AE5A-0000F87571E3}. versionNumber attribute incremented. PowerShell ScriptBlock Log Event ID 4104 with SYSVOL path construction and file write commands.
References (9)
- https://attack.mitre.org/techniques/T1484/001/
- https://wald0.com/?p=179
- https://blog.harmj0y.net/redteaming/abusing-gpo-permissions/
- https://blog.harmj0y.net/activedirectory/the-most-dangerous-user-right-you-probably-have-never-heard-of/
- https://adsecurity.org/?p=2716
- https://github.com/FSecureLABS/SharpGPOAbuse
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-directory-service-changes
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1484.001/T1484.001.md
Unlock Pro Content
Get the full detection package for T1484.001 including response playbook, investigation guide, and atomic red team tests.