Detect Group Policy Modification in Splunk
Adversaries may modify Group Policy Objects (GPOs) to subvert intended access controls across a Windows domain, typically to escalate privileges, disable security tools, or enable mass payload distribution. GPOs stored in SYSVOL control centralized user and computer settings across Active Directory environments. Malicious GPO modifications can deploy scheduled tasks, create accounts, grant dangerous privileges like SeEnableDelegationPrivilege, or push ransomware to every domain-joined machine simultaneously. LockBit 2.0/3.0 and Qilin ransomware modified GPOs to disable Windows Defender and propagate malware domain-wide. APT41 used GPO-deployed scheduled tasks for coordinated ransomware deployment. Indrik Spider (Evil Corp), Cinnamon Tempest, and Storm-0501 have all leveraged GPO modification for lateral movement and payload execution at scale. The Empire framework's New-GPOImmediateTask cmdlet and SharpGPOAbuse tool provide ready-made capabilities for GPO abuse by threat actors with sufficient AD permissions.
MITRE ATT&CK
- Sub-technique
- T1484.001 Group Policy Modification
- Canonical reference
- https://attack.mitre.org/techniques/T1484/001/
SPL Detection Query
| union
[search index=wineventlog sourcetype="WinEventLog:Security" (EventCode=5136 OR EventCode=5137 OR EventCode=5138 OR EventCode=5141)
| rex field=_raw "Object DN:\s+(?P<ObjectDN>[^\r\n]+)"
| rex field=_raw "Object Class:\s+(?P<ObjectClass>[^\r\n]+)"
| rex field=_raw "LDAP Display Name:\s+(?P<AttributeLDAPDisplayName>[^\r\n]+)"
| rex field=_raw "Attribute Value:\s+(?P<AttributeValue>[^\r\n]+)"
| rex field=_raw "Subject:\s*\n\s+Security ID:\s+[^\n]+\n\s+Account Name:\s+(?P<SubjectUserName>[^\r\n]+)"
| rex field=_raw "Account Domain:\s+(?P<SubjectDomainName>[^\r\n]+)"
| where (ObjectClass="groupPolicyContainer" OR like(ObjectDN, "%CN=Policies%CN=System%"))
| eval GPOOperation=case(
EventCode=5136, "GPO Attribute Modified",
EventCode=5137, "GPO Created",
EventCode=5138, "GPO Undeleted",
EventCode=5141, "GPO Deleted",
true(), "GPO Changed"
)
| eval IsHighRisk=if(match(AttributeLDAPDisplayName, "(?i)(gPCMachineExtensionNames|gPCUserExtensionNames|nTSecurityDescriptor|gPCFileSysPath)"), 1, 0)
| eval IsDefaultGPO=if(match(ObjectDN, "(?i)(Default Domain Policy|Default Domain Controllers Policy)"), 1, 0)
| eval Source="AD_DirectoryAudit"
| table _time, host, SubjectUserName, SubjectDomainName, GPOOperation, ObjectDN, AttributeLDAPDisplayName, AttributeValue, IsHighRisk, IsDefaultGPO, Source]
[search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| where like(TargetFilename, "%\\SYSVOL\\%") OR like(TargetFilename, "%\\sysvol\\%")
| eval FileName=mvindex(split(TargetFilename, "\\"), -1)
| where FileName IN ("ScheduledTasks.xml", "GptTmpl.inf", "GPT.INI", "Startup.xml", "Shutdown.xml", "Registry.xml", "Services.xml", "Groups.xml")
OR match(TargetFilename, "(?i)\\\\Policies\\\\\{[0-9A-Fa-f\\-]{36}\\}\\\\")
| eval IsHighRisk=if(FileName IN ("ScheduledTasks.xml", "GptTmpl.inf"), 1, 0)
| eval GPOOperation="SYSVOL File Created/Modified"
| eval Source="SYSVOL_FileSystem"
| eval SubjectUserName=User, ObjectDN=TargetFilename, AttributeLDAPDisplayName=FileName, IsDefaultGPO=0
| table _time, host, SubjectUserName, GPOOperation, ObjectDN, AttributeLDAPDisplayName, IsHighRisk, IsDefaultGPO, Source, Image, CommandLine]
[search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
(CommandLine="*New-GPOImmediateTask*" OR CommandLine="*New-GPO*" OR CommandLine="*Set-GPOLink*"
OR CommandLine="*Import-GPO*" OR CommandLine="*Set-GPPermissions*" OR CommandLine="*SharpGPOAbuse*"
OR CommandLine="*Invoke-GPOZaurr*" OR CommandLine="*SeEnableDelegationPrivilege*"
OR CommandLine="*GptTmpl.inf*" OR CommandLine="*Get-GPPermissions*")
| eval IsHighRisk=if(match(CommandLine, "(?i)(SharpGPOAbuse|Invoke-GPOZaurr|New-GPOImmediateTask|SeEnableDelegationPrivilege)"), 1, 0)
| eval GPOOperation="GPO Tool PowerShell Execution"
| eval Source="PowerShell_GPOTools"
| eval SubjectUserName=User, ObjectDN=CommandLine, AttributeLDAPDisplayName="PowerShell", IsDefaultGPO=0
| table _time, host, SubjectUserName, GPOOperation, ObjectDN, AttributeLDAPDisplayName, IsHighRisk, IsDefaultGPO, Source, Image, CommandLine]
| eval RiskScore=if(IsHighRisk=1, 75, 40) + if(IsDefaultGPO=1, 25, 0)
| where RiskScore > 0
| sort - _time
| table _time, Source, host, SubjectUserName, GPOOperation, ObjectDN, AttributeLDAPDisplayName, IsHighRisk, IsDefaultGPO, RiskScoreMulti-branch SPL detection covering three GPO modification vectors unified with a risk scoring model: (1) WinEventLog:Security events 5136/5137/5138/5141 using rex field extraction for ObjectDN, ObjectClass, and AttributeLDAPDisplayName to identify AD-level GPO changes on Domain Controllers; (2) Sysmon Event ID 11 (File Created) monitoring SYSVOL paths for GPO content file modifications including ScheduledTasks.xml and GptTmpl.inf; (3) Sysmon Event ID 1 (Process Create) for PowerShell execution of GPO management cmdlets and known attack tools. A composite risk score elevates alerts for high-risk attribute changes (+75) and modifications to Default Domain Policy (+25). Requires Windows AD auditing enabled for DS Access category on Domain Controllers.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Authorized domain administrators using GPMC or PowerShell RSAT during scheduled change windows — cross-reference SubjectUserName against approved change management records
- MECM/SCCM or Intune service accounts performing automated GPO management for device compliance and software deployment
- Automated security configuration tools performing GPO-based hardening (CIS Benchmarks, DISA STIG) during maintenance windows
- GPO backup and restore procedures that touch multiple SYSVOL files simultaneously
- Domain provisioning and imaging workflows that link or create GPOs as part of new OU/site configuration
Other platforms for T1484.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Malicious Scheduled Task via GPO (New-GPOImmediateTask)
Expected signal: Security Event ID 5137 on Domain Controller: GPO container object created (ObjectClass=groupPolicyContainer). Security Event ID 5136 on DC: gPCMachineExtensionNames attribute added (indicating new machine policy CSE). Sysmon Event ID 11: File Create for ScheduledTasks.xml in SYSVOL path from PowerShell process. Security Event ID 5136: versionNumber attribute incremented on GPO object. PowerShell ScriptBlock Log (Event ID 4104) capturing New-GPO, New-GPLink, and file write operations.
- Test 2Modify GptTmpl.inf to Grant SeEnableDelegationPrivilege
Expected signal: Sysmon Event ID 11: File Create for GptTmpl.inf in SYSVOL path (\\DOMAIN\SYSVOL\DOMAIN\Policies\{GUID}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf). Security Event ID 5136 on DC: gPCMachineExtensionNames updated to include security extension GUID {827D319E-6EAC-11D2-A4EA-00C04F79F83A} (Security). versionNumber increment. PowerShell ScriptBlock Log Event ID 4104 capturing the file write and SYSVOL path construction.
- Test 3Enumerate GPO Permissions with PowerView (Recon Phase)
Expected signal: PowerShell ScriptBlock Log Event ID 4104: Get-GPPermissions cmdlet execution with -All parameter iterating across all GPOs. Sysmon Event ID 1: powershell.exe process creation with Get-GPPermissions and Get-GPO in command line. Active Directory query events may appear in Domain Controller logs for LDAP searches against CN=Policies.
- Test 4Deploy Ransomware Simulation via GPO Startup Script
Expected signal: Sysmon Event ID 11: File Create events for startup.bat and scripts.ini in SYSVOL path from powershell.exe. Security Event ID 5136 on DC: gPCMachineExtensionNames updated to include scripts CSE GUID {42B5FAAE-6536-11D2-AE5A-0000F87571E3}. versionNumber attribute incremented. PowerShell ScriptBlock Log Event ID 4104 with SYSVOL path construction and file write commands.
References (9)
- https://attack.mitre.org/techniques/T1484/001/
- https://wald0.com/?p=179
- https://blog.harmj0y.net/redteaming/abusing-gpo-permissions/
- https://blog.harmj0y.net/activedirectory/the-most-dangerous-user-right-you-probably-have-never-heard-of/
- https://adsecurity.org/?p=2716
- https://github.com/FSecureLABS/SharpGPOAbuse
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-directory-service-changes
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1484.001/T1484.001.md
Unlock Pro Content
Get the full detection package for T1484.001 including response playbook, investigation guide, and atomic red team tests.