Modify Group Policy (Windows Event Log)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain. Group policy allows for centralized management of user and computer settings in Active Directory (AD). This use case looks for event codes associated with modifications to policy objects

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1484.001` Domain or Tenant Policy Modification: Group Policy Modification
Defense Impairment	`T1484.001` Domain or Tenant Policy Modification: Group Policy Modification

References

https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 5136: A directory service object was modified.
Security-Auditing	Event ID 5137: A directory service object was created.
Security-Auditing	Event ID 5138: A directory service object was undeleted.
Security-Auditing	Event ID 5139: A directory service object was moved.
Security-Auditing	Event ID 5141: A directory service object was deleted.

Rule body

id: '8200.10098'
title: Modify Group Policy
description: 'Adversaries may modify Group Policy Objects (GPOs) to subvert the intended
  discretionary access controls for a domain, usually with the intention of escalating
  privileges on the domain. Group policy allows for centralized management of user
  and computer settings in Active Directory (AD). This use case looks for event codes
  associated with modifications to policy objects. -- Software Association: Black
  Basta, CaddyWiper, Conti, HermeticWiper, Hive, LV, Play, Prestige, Royal'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5136) OR
  TERM(EventCode=5137) OR TERM(EventCode=5138) OR TERM(EventCode=5139) OR TERM(EventCode=5141)
  OR "<EventID>5136<" OR "<EventID>5137<" OR "<EventID>5138<" OR "<EventID>5139<"
  OR "<EventID>5141<") | table _time, host, user signature | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:domain policy modification:group policy modification
- privilege-escalation:domain policy modification:group policy modification
technique_id:
- T1484.001
data_category:
- Windows event logs
references:
- https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5136) OR TERM(EventCode=5137) OR TERM(EventCode=5138) OR TERM(EventCode=5139) OR TERM(EventCode=5141) OR "<EventID>5136<" OR "<EventID>5137<" OR "<EventID>5138<" OR "<EventID>5139<" OR "<EventID>5141<")

Stage 2: `table`

| table _time, host, user signature

Stage 3: `bucket`

| bin span=1s

Stage 4: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`5136` corpus 45 (splunk 24, kusto 18, elastic 3) `5137` corpus 14 (splunk 5, kusto 5, elastic 4) `5138` corpus 2 (splunk 1, kusto 1) `5139` corpus 2 (splunk 1, kusto 1) `5141` corpus 4 (splunk 2, kusto 2)	`field:"EventID" kind:eq`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>5136<"`
1	`"<EventID>5137<"`
1	`"<EventID>5138<"`
1	`"<EventID>5139<"`
1	`"<EventID>5141<"`