detection.wiki

Detection rules › Sigma

Suspicious modification of a sensitive Group Policy (GPO)

Status
experimental
Severity
medium
Log source
product windows, service security
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker will attempt to take control over a group policy.

Known false positives

  • Group policy administrator activity / AGPM activity

MITRE ATT&CK coverage

TacticTechniques
Privilege Escalation

Telemetry coverage

ProviderRecord / event type
Security-AuditingEvent ID 5136: A directory service object was modified.

Rule body

title: Suspicious modification of a sensitive Group Policy (GPO)
description: Detects scenarios where an attacker will attempt to take control over a group policy.
requirements: native and existing auditing SACL ("Write all properties") should already be present on "Policies" container.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0004-Privilege%20Escalation/T1484.001-Domain%20Policy%20Modification-Group%20Policy%20Modification
tags:
- attack.privilege_escalation
- attack.t1484.001
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5136
    AttributeLDAPDisplayName: versionNumber
    ObjectClass: groupPolicyContainer
    OperationType: '%%14674' # Value is added
    ObjectGUID|contains:     # List of sensitive GPO GUID
      - xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
      - xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
      - xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
      - xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
  filter:
    AttributeValue: '0' # First value when GPO is created. Refers to the GPO version number.
  condition: selection and not filter
falsepositives:
- Group policy administrator activity / AGPM activity
level: medium

Stages and Predicates

Stage 0: condition

selection and not filter

Stage 1: selection

selection:
  EventID: 5136
  AttributeLDAPDisplayName: versionNumber
  ObjectClass: groupPolicyContainer
  OperationType: '%%14674'
  ObjectGUID|contains:
    - xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
    - xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
    - xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
    - xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

Stage 2: not filter

filter:
  AttributeValue: '0'

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
AttributeValueeq0excludes:AttributeValue field:"AttributeValue" value:"0"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
AttributeLDAPDisplayNameeq
  • versionNumber corpus 2 (sigma 1, splunk 1)
field:"AttributeLDAPDisplayName" kind:eq value:"versionNumber"
ObjectClasseq
  • groupPolicyContainer corpus 6 (sigma 3, splunk 3)
field:"ObjectClass" kind:eq value:"groupPolicyContainer"
ObjectGUIDmatch
  • xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
field:"ObjectGUID" kind:match value:"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
OperationTypeeq
  • %%14674 corpus 17 (sigma 9, elastic 4, splunk 4)
field:"OperationType" kind:eq value:"%%14674"