T1484.001 Group Policy Modification
Sub-technique of T1484 Domain or Tenant Policy Modification
Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain. Group policy allows for centralized management of user and computer settings in Active Directory (AD). GPOs are containers for group policy settings made up of files stored within a predictable network path…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Group Policy Abuse for Privilege Additionmediumtest · windows
- Modify Group Policy Settingsmediumtest · windows
- Modify Group Policy Settings - ScriptBlockLoggingmediumtest · windows
- Startup/Logon Script Added to Group Policy Objectmediumtest · windows
- Windows Default Domain GPO Modificationmediumexperimental · windows
- Windows Default Domain GPO Modification via GPMEmediumexperimental · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.