{"id":"e5ac86dd-2da1-454b-be74-05d26c769d7d","title":"Windows Default Domain GPO Modification","description":"Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs).\nAdversaries may modify these default GPOs to deploy malicious configurations across the domain.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-11-22","modified":"","tags":["attack.privilege-escalation","attack.defense-impairment","attack.t1484.001"],"technique_ids":["T1484.001"],"logsource":{"product":"windows","service":"security","definition":"Enable 'Audit Directory Service Changes' in the Default Domain Controllers Policy under:\nComputer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> Audit Policies -> DS Access -> Audit Directory Service Changes (Success).\nAdditionally, proper SACL needs to be configured on the 'CN=Policies,CN=System,DC=<domain>,DC=<tld>' container in Active Directory to capture changes to Group Policy Objects.\n"},"falsepositives":["Legitimate modifications to Default Domain or Default Domain Controllers GPOs"],"references":["https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html","https://adsecurity.org/?p=3377","https://www.pentestpartners.com/security-blog/living-off-the-land-gpo-style/","https://jgspiers.com/audit-group-policy-changes/"],"source_path":"rules/windows/builtin/security/win_security_default_domain_gpo_modification.yml","source_sha256":"913d4786fdb9cf6b05d9e1a5724064ac2d3e5e55f19674ff43a33c5f42e7c769","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_default_domain_gpo_modification.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Windows Default Domain GPO Modification\nid: e5ac86dd-2da1-454b-be74-05d26c769d7d\nrelated:\n    - id: dcff7e85-d01f-4eb5-badd-84e2e6be8294\n      type: similar\nstatus: experimental\ndescription: |\n    Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs).\n    Adversaries may modify these default GPOs to deploy malicious configurations across the domain.\nreferences:\n    - https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html\n    - https://adsecurity.org/?p=3377\n    - https://www.pentestpartners.com/security-blog/living-off-the-land-gpo-style/\n    - https://jgspiers.com/audit-group-policy-changes/\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-11-22\ntags:\n    - attack.privilege-escalation\n    - attack.defense-impairment\n    - attack.t1484.001\nlogsource:\n    product: windows\n    service: security\n    definition: |\n        Enable 'Audit Directory Service Changes' in the Default Domain Controllers Policy under:\n        Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> Audit Policies -> DS Access -> Audit Directory Service Changes (Success).\n        Additionally, proper SACL needs to be configured on the 'CN=Policies,CN=System,DC=<domain>,DC=<tld>' container in Active Directory to capture changes to Group Policy Objects.\ndetection:\n    selection:\n        EventID: 5136\n        ObjectClass: 'groupPolicyContainer'\n        ObjectDN|startswith:\n            - 'CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM' # Default Domain Policy\n            - 'CN={6AC1786C-016F-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM' # Default Domain Controllers Policy\n    condition: selection\nfalsepositives:\n    - Legitimate modifications to Default Domain or Default Domain Controllers GPOs\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1484.001","id":"T1484.001","name":"Group Policy Modification","page":"techniques/enterprise/T1484.001/"}],"data_path":"data/detection-rules/e5ac86dd-2da1-454b-be74-05d26c769d7d.json","kind":"sigma"}