Windows Default Domain GPO Modification via GPME

Status: experimental
Severity: medium
Log source: category process_creation, product windows
Author: TropChaud
Source: github.com/SigmaHQ/sigma

Detects the use of the Group Policy Management Editor (GPME) to modify Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may leverage GPME to make stealthy changes in these default GPOs to deploy malicious GPOs configurations across the domain without raising suspicion.

Known false positives

Legitimate use of GPME to modify GPOs

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1484.001` Domain or Tenant Policy Modification: Group Policy Modification
Defense Impairment	`T1484.001` Domain or Tenant Policy Modification: Group Policy Modification

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Windows Default Domain GPO Modification via GPME
id: dcff7e85-d01f-4eb5-badd-84e2e6be8294
related:
    - id: e5ac86dd-2da1-454b-be74-05d26c769d7d
      type: similar
status: experimental
description: |
    Detects the use of the Group Policy Management Editor (GPME) to modify Default Domain or Default Domain Controllers Group Policy Objects (GPOs).
    Adversaries may leverage GPME to make stealthy changes in these default GPOs to deploy malicious GPOs configurations across the domain without raising suspicion.
references:
    - https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html
    - https://adsecurity.org/?p=3377
    - https://sdmsoftware.com/general-stuff/launching-the-new-gp-management-editor-from-the-command-line/
    - https://www.pentestpartners.com/security-blog/living-off-the-land-gpo-style/
author: TropChaud
date: 2025-11-22
tags:
    - attack.privilege-escalation
    - attack.defense-impairment
    - attack.t1484.001
logsource:
    product: windows
    category: process_creation
detection:
    # "C:\Windows\System32\gpme.msc" /s /gpobject:"LDAP://<REDACTED>/cn<REDACTED>,cnpolicies,cnsystem,DC<REDACTED>,DClocal"
    selection_mmc:
        - Image|endswith: '\mmc.exe'
        - OriginalFileName: 'MMC.exe'
    selection_gpme:
        CommandLine|contains|all:
            - 'gpme.msc'
            - 'gpobject:'
    selection_default_gpos:
        CommandLine|contains:
            - '31B2F340-016D-11D2-945F-00C04FB984F9' # Default Domain Policy GUID
            - '6AC1786C-016F-11D2-945F-00C04FB984F9' # Default Domain Controllers Policy GUID
    condition: all of selection_*
falsepositives:
    - Legitimate use of GPME to modify GPOs
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_mmc`

selection_mmc:
    - Image|endswith: '\mmc.exe'
    - OriginalFileName: 'MMC.exe'

Stage 2: `selection_gpme`

selection_gpme:
    CommandLine|contains|all:
        - 'gpme.msc'
        - 'gpobject:'

Stage 3: `selection_default_gpos`

selection_default_gpos:
    CommandLine|contains:
        - '31B2F340-016D-11D2-945F-00C04FB984F9'
        - '6AC1786C-016F-11D2-945F-00C04FB984F9'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`31B2F340-016D-11D2-945F-00C04FB984F9` corpus 2 (sigma 1, splunk 1) `6AC1786C-016F-11D2-945F-00C04FB984F9` corpus 2 (sigma 1, splunk 1) `gpme.msc` corpus 2 (sigma 1, splunk 1) `gpobject:`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\mmc.exe` corpus 5 (sigma 5)	`field:"Image" kind:ends_with value:"\mmc.exe"`
`OriginalFileName`	eq	`MMC.exe` corpus 2 (sigma 2)	`field:"OriginalFileName" kind:eq value:"MMC.exe"`