Modify Group Policy Settings - ScriptBlockLogging

Title: Modify Group Policy Settings - ScriptBlockLogging
Status: test
Description:Detect malicious GPO modifications can be used to implement many other malicious behaviors.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1484.001/T1484.001.md
Author: frack113
Date: 2022-08-19
modified:None
Tags:

• -'attack.privilege-escalation'
• -'attack.defense-impairment'
• -'attack.t1484.001'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection_path:
    ScriptBlockText|contains: '\SOFTWARE\Policies\Microsoft\Windows\System'
  selection_key:
    ScriptBlockText|contains:
      -'GroupPolicyRefreshTimeDC'
      -'GroupPolicyRefreshTimeOffsetDC'
      -'GroupPolicyRefreshTime'
      -'GroupPolicyRefreshTimeOffset'
      -'EnableSmartScreen'
      -'ShellSmartScreenLevel'

  condition:all of selection_*
Falsepositives:
  -Legitimate use
Level: medium