Detect Group Policy Modification in Sumo Logic CSE
Adversaries may modify Group Policy Objects (GPOs) to subvert intended access controls across a Windows domain, typically to escalate privileges, disable security tools, or enable mass payload distribution. GPOs stored in SYSVOL control centralized user and computer settings across Active Directory environments. Malicious GPO modifications can deploy scheduled tasks, create accounts, grant dangerous privileges like SeEnableDelegationPrivilege, or push ransomware to every domain-joined machine simultaneously. LockBit 2.0/3.0 and Qilin ransomware modified GPOs to disable Windows Defender and propagate malware domain-wide. APT41 used GPO-deployed scheduled tasks for coordinated ransomware deployment. Indrik Spider (Evil Corp), Cinnamon Tempest, and Storm-0501 have all leveraged GPO modification for lateral movement and payload execution at scale. The Empire framework's New-GPOImmediateTask cmdlet and SharpGPOAbuse tool provide ready-made capabilities for GPO abuse by threat actors with sufficient AD permissions.
MITRE ATT&CK
- Sub-technique
- T1484.001 Group Policy Modification
- Canonical reference
- https://attack.mitre.org/techniques/T1484/001/
Sumo Detection Query
(_sourceCategory="windows/security" OR _sourceCategory="windows/sysmon")
// Extract common fields from raw event text
| parse regex "(?s)EventID[=:\s]+(?P<EventID>\d+)" nodrop
| parse regex "(?i)Object DN[:\s]+(?P<ObjectDN>[^\r\n]+)" nodrop
| parse regex "(?i)Object Class[:\s]+(?P<ObjectClass>[^\r\n]+)" nodrop
| parse regex "(?i)LDAP Display Name[:\s]+(?P<LDAPAttribute>[^\r\n]+)" nodrop
| parse regex "(?i)Account Name[:\s]+(?P<SubjectUser>[^\r\n]+)" nodrop
| parse regex "(?i)TargetFilename[:\s]+(?P<TargetFilename>[^\r\n]+)" nodrop
| parse regex "(?i)CommandLine[:\s]+(?P<CommandLine>[^\r\n]+)" nodrop
| parse regex "(?i)Image[:\s]+(?P<Image>[^\r\n]+)" nodrop
// Filter to GPO-relevant events across all three detection branches
| where
// Branch 1: AD Directory Audit — GPO object create/modify/delete
(EventID in ("5136","5137","5138","5141")
AND (ObjectClass matches "(?i).*groupPolicyContainer.*"
OR ObjectDN matches "(?i).*CN=Policies.*CN=System.*"))
// Branch 2: SYSVOL filesystem modification (Sysmon Event 11)
OR (EventID = "11"
AND TargetFilename matches "(?i).*\\\\sysvol\\\\.*"
AND TargetFilename matches "(?i).*(ScheduledTasks\.xml|GptTmpl\.inf|GPT\.INI|Registry\.xml|Startup\.xml|Shutdown\.xml|Groups\.xml|Services\.xml).*")
// Branch 3: PowerShell GPO cmdlets and known attack tools
OR (EventID in ("1","4688")
AND (Image matches "(?i).*(powershell|pwsh)\.exe")
AND CommandLine matches "(?i).*(New-GPOImmediateTask|SharpGPOAbuse|Invoke-GPOZaurr|Set-GPPermissions|SeEnableDelegationPrivilege|Import-GPO|Set-GPOLink|GptTmpl\.inf|New-GPLink|Set-GPRegistryValue).*")
// Classify detection source
| if (EventID in ("5136","5137","5138","5141"), "AD_DirectoryAudit",
if (EventID = "11", "SYSVOL_FileSystem", "PowerShell_GPOTools")) as DetectionSource
// Compute GPO operation label
| if (EventID = "5137", "GPO Created",
if (EventID = "5138", "GPO Undeleted",
if (EventID = "5141", "GPO Deleted",
if (EventID = "5136", "GPO Attribute Modified",
if (EventID = "11", "SYSVOL File Created/Modified",
"GPO Tool Execution"))))) as GPOOperation
// High-risk flag: dangerous LDAP attributes, attack tools, or critical GPO files
| if (
LDAPAttribute matches "(?i).*(gPCMachineExtensionNames|gPCUserExtensionNames|nTSecurityDescriptor|gPCFileSysPath|versionNumber).*"
OR CommandLine matches "(?i).*(SharpGPOAbuse|Invoke-GPOZaurr|New-GPOImmediateTask|SeEnableDelegationPrivilege).*"
OR TargetFilename matches "(?i).*(ScheduledTasks\.xml|GptTmpl\.inf).*"
, 1, 0) as IsHighRisk
| if (ObjectDN matches "(?i).*(Default Domain Policy|Default Domain Controllers Policy).*", 1, 0) as IsDefaultGPO
| toInt(IsHighRisk) * 75 + toInt(IsDefaultGPO) * 25 as RiskScore
| where RiskScore > 0
| fields _messageTime, DetectionSource, _sourceHost, SubjectUser, EventID, GPOOperation, ObjectDN, LDAPAttribute, CommandLine, TargetFilename, IsHighRisk, IsDefaultGPO, RiskScore
| sort by _messageTime descSumo Logic detection for T1484.001 Group Policy Modification covering three telemetry branches: AD Directory Service audit events (5136/5137/5138/5141) for GPO object lifecycle changes, Sysmon Event 11 SYSVOL filesystem writes targeting critical GPO policy content files, and PowerShell process events containing GPO management cmdlets or attack tool signatures. Applies a risk scoring model (75 for high-risk attributes/tools + 25 for Default Domain Policy targets) to prioritize the most dangerous modifications.
Data Sources
Required Tables
False Positives & Tuning
- Active Directory Group Policy administrators using GPMC or RSAT PowerShell tools during approved change windows — 5136 events fire on every attribute write including benign changes; filter by SubjectUser against a known GPO admin whitelist
- SYSVOL DFS-R replication between domain controllers generates SYSVOL file creation/modification events as policy changes propagate across the domain — these will appear on all DCs, not just the one where the change originated
- Microsoft Defender for Identity (MDI) or similar AD monitoring agents that actively read GPO objects and SYSVOL content as part of baseline collection may generate file read events that surface as file creation in some logging configurations
- Change management tooling (ServiceNow orchestration, Puppet, Chef) that applies Group Policy changes via PowerShell automation accounts on a schedule — these produce legitimate GPO cmdlet executions that match the PowerShell branch
Other platforms for T1484.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Malicious Scheduled Task via GPO (New-GPOImmediateTask)
Expected signal: Security Event ID 5137 on Domain Controller: GPO container object created (ObjectClass=groupPolicyContainer). Security Event ID 5136 on DC: gPCMachineExtensionNames attribute added (indicating new machine policy CSE). Sysmon Event ID 11: File Create for ScheduledTasks.xml in SYSVOL path from PowerShell process. Security Event ID 5136: versionNumber attribute incremented on GPO object. PowerShell ScriptBlock Log (Event ID 4104) capturing New-GPO, New-GPLink, and file write operations.
- Test 2Modify GptTmpl.inf to Grant SeEnableDelegationPrivilege
Expected signal: Sysmon Event ID 11: File Create for GptTmpl.inf in SYSVOL path (\\DOMAIN\SYSVOL\DOMAIN\Policies\{GUID}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf). Security Event ID 5136 on DC: gPCMachineExtensionNames updated to include security extension GUID {827D319E-6EAC-11D2-A4EA-00C04F79F83A} (Security). versionNumber increment. PowerShell ScriptBlock Log Event ID 4104 capturing the file write and SYSVOL path construction.
- Test 3Enumerate GPO Permissions with PowerView (Recon Phase)
Expected signal: PowerShell ScriptBlock Log Event ID 4104: Get-GPPermissions cmdlet execution with -All parameter iterating across all GPOs. Sysmon Event ID 1: powershell.exe process creation with Get-GPPermissions and Get-GPO in command line. Active Directory query events may appear in Domain Controller logs for LDAP searches against CN=Policies.
- Test 4Deploy Ransomware Simulation via GPO Startup Script
Expected signal: Sysmon Event ID 11: File Create events for startup.bat and scripts.ini in SYSVOL path from powershell.exe. Security Event ID 5136 on DC: gPCMachineExtensionNames updated to include scripts CSE GUID {42B5FAAE-6536-11D2-AE5A-0000F87571E3}. versionNumber attribute incremented. PowerShell ScriptBlock Log Event ID 4104 with SYSVOL path construction and file write commands.
References (9)
- https://attack.mitre.org/techniques/T1484/001/
- https://wald0.com/?p=179
- https://blog.harmj0y.net/redteaming/abusing-gpo-permissions/
- https://blog.harmj0y.net/activedirectory/the-most-dangerous-user-right-you-probably-have-never-heard-of/
- https://adsecurity.org/?p=2716
- https://github.com/FSecureLABS/SharpGPOAbuse
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-directory-service-changes
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1484.001/T1484.001.md
Unlock Pro Content
Get the full detection package for T1484.001 including response playbook, investigation guide, and atomic red team tests.