Title:Group Policy Abuse for Privilege Addition Status:test Description:Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins.
References: -https://www.elastic.co/guide/en/security/current/group-policy-abuse-for-privilege-addition.html#_setup_275 Author: Elastic, Josh Nickels, Marius Rothenbücher Date: 2024-09-04 modified:None Tags:
-'attack.privilege-escalation'
-'attack.defense-impairment'
-'attack.t1484.001'
Logsource:
product: windows
service: security
definition: Requirements: The "Audit Directory Service Changes" logging policy must be configured in order to receive events.
