Detection rules › Splunk
Modify Group Policy (Windows Event Log)
Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain. Group policy allows for centralized management of user and computer settings in Active Directory (AD). This use case looks for event codes associated with modifications to policy objects
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Privilege Escalation | T1484.001 Domain or Tenant Policy Modification: Group Policy Modification |
| Defense Impairment | T1484.001 Domain or Tenant Policy Modification: Group Policy Modification |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 5136 | A directory service object was modified. |
| Security-Auditing | Event ID 5137 | A directory service object was created. |
| Security-Auditing | Event ID 5138 | A directory service object was undeleted. |
| Security-Auditing | Event ID 5139 | A directory service object was moved. |
| Security-Auditing | Event ID 5141 | A directory service object was deleted. |
Rule body yaml
id: '8200.10098'
title: Modify Group Policy
description: 'Adversaries may modify Group Policy Objects (GPOs) to subvert the intended
discretionary access controls for a domain, usually with the intention of escalating
privileges on the domain. Group policy allows for centralized management of user
and computer settings in Active Directory (AD). This use case looks for event codes
associated with modifications to policy objects. -- Software Association: Black
Basta, CaddyWiper, Conti, HermeticWiper, Hive, LV, Play, Prestige, Royal'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5136) OR
TERM(EventCode=5137) OR TERM(EventCode=5138) OR TERM(EventCode=5139) OR TERM(EventCode=5141)
OR "<EventID>5136<" OR "<EventID>5137<" OR "<EventID>5138<" OR "<EventID>5139<"
OR "<EventID>5141<") | table _time, host, user signature | bin span=1s | stats values(*)
as * by _time, host '
techniques:
- defense-evasion:domain policy modification:group policy modification
- privilege-escalation:domain policy modification:group policy modification
technique_id:
- T1484.001
data_category:
- Windows event logs
references:
- https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5136) OR TERM(EventCode=5137) OR TERM(EventCode=5138) OR TERM(EventCode=5139) OR TERM(EventCode=5141) OR "<EventID>5136<" OR "<EventID>5137<" OR "<EventID>5138<" OR "<EventID>5139<" OR "<EventID>5141<")
Stage 2: table
| table _time, host, user signature
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | TERM |
| 1 | TERM |
| 1 | TERM |
| 1 | TERM |
| 1 | "<EventID>5136<" |
| 1 | "<EventID>5137<" |
| 1 | "<EventID>5138<" |
| 1 | "<EventID>5139<" |
| 1 | "<EventID>5141<" |