T1484.001 Group Policy Modification

Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain. Group policy allows for centralized management of user and computer settings in Active Directory (AD). GPOs are containers for group policy settings made up of files stored within a predictable network path…

Ficha en MITRE ATT&CK ↗

Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.