detection.wiki

Detection rules › Sigma

Permissions changed on a Group Policy (GPO)

Status
experimental
Severity
medium
Log source
product windows, service security
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker will attempt to take control over a group policy.

Known false positives

  • Group policy administrator activity / AGPM activity

MITRE ATT&CK coverage

TacticTechniques
Privilege Escalation

Telemetry coverage

ProviderRecord / event type
Security-AuditingEvent ID 5136: A directory service object was modified.

Rule body

title: Permissions changed on a Group Policy (GPO)
description: Detects scenarios where an attacker will attempt to take control over a group policy.
requirements: auditing SACL "Modify permissions" must be placed on the "Policies" container using the Active Directory console (https://www.manageengine.com/products/active-directory-audit/active-directory-auditing-configuration-guide-configure-object-level-auditing-manually.html).
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1222.001-File%20and%20Directory%20Permissions%20Modification
tags:
- attack.privilege_escalation
- attack.t1484.001
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5136
    AttributeLDAPDisplayName: ntSecurityDescriptor
    ObjectClass: groupPolicyContainer
    OperationType: '%%14674' # Value is added
  filter:
    SubjectUserName: # AGPM servers (to customize)
      - SRVAGPM01$
      - SRVAGPM02$
  condition: selection and not filter
falsepositives:
- Group policy administrator activity / AGPM activity
level: medium

Stages and Predicates

Stage 0: condition

selection and not filter

Stage 1: selection

selection:
  EventID: 5136
  AttributeLDAPDisplayName: ntSecurityDescriptor
  ObjectClass: groupPolicyContainer
  OperationType: '%%14674'

Stage 2: not filter

filter:
  SubjectUserName:
    - SRVAGPM01$
    - SRVAGPM02$

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
SubjectUserNameeqSRVAGPM01$excludes:SubjectUserName field:"SubjectUserName" value:"SRVAGPM01$"
SubjectUserNameeqSRVAGPM02$excludes:SubjectUserName field:"SubjectUserName" value:"SRVAGPM02$"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
AttributeLDAPDisplayNameeq
  • ntSecurityDescriptor corpus 7 (sigma 6, elastic 1)
field:"AttributeLDAPDisplayName" kind:eq value:"ntSecurityDescriptor"
ObjectClasseq
  • groupPolicyContainer corpus 6 (sigma 3, splunk 3)
field:"ObjectClass" kind:eq value:"groupPolicyContainer"
OperationTypeeq
  • %%14674 corpus 17 (sigma 9, elastic 4, splunk 4)
field:"OperationType" kind:eq value:"%%14674"