Name:Windows Admon Default Group Policy Object Modified id:83458004-db60-4170-857d-8572f16f070b version:4 date:2024-09-30 author:Mauricio Velazco, Splunk status:production type:TTP Description:The following analytic detects modifications to the default Group Policy Objects (GPOs) in an Active Directory environment. It leverages Splunk's Admon to monitor updates to the "Default Domain Policy" and "Default Domain Controllers Policy." This activity is significant because changes to these default GPOs can indicate an adversary with privileged access attempting to gain further control, establish persistence, or deploy malware across multiple hosts. If confirmed malicious, such modifications could lead to widespread policy enforcement changes, unauthorized access, and potential compromise of the entire domain environment. Data_source:
-Windows Active Directory Admon
search:`admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*" (displayName="Default Domain Policy" OR displayName="Default Domain Controllers Policy") | stats min(_time) as firstTime max(_time) as lastTime values(gPCFileSysPath) by dcName, displayName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_admon_default_group_policy_object_modified_filter`
how_to_implement:To successfully implement this search, you need to be monitoring Active Directory logs using Admon. Details can be found here https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Data/MonitorActiveDirectory known_false_positives:The default Group Policy Objects within an AD network may be legitimately updated for administrative operations, filter as needed. References: -https://attack.mitre.org/techniques/T1484/ -https://attack.mitre.org/techniques/T1484/001 -https://www.trustedsec.com/blog/weaponizing-group-policy-objects-access/ -https://adsecurity.org/?p=2716 -https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Data/MonitorActiveDirectory drilldown_searches: name:'View the detection results for - "$dcName$"' search:'%original_detection_search% | search dcName = "$dcName$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$dcName$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dcName$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' tags: analytic_story: - 'Active Directory Privilege Escalation' - 'Sneaky Active Directory Persistence Tricks' asset_type:Endpoint confidence:50 impact:100 message:A default domain group policy was updated on $dcName$ mitre_attack_id: - 'T1484' - 'T1484.001' observable: name:'dcName' type:'Endpoint' - role: - 'Victim' product: - 'Splunk Enterprise' - 'Splunk Enterprise Security' - 'Splunk Cloud' required_fields: - '_time' - 'admonEventType' - 'objectCategory' - 'displayName' - 'gPCFileSysPath' - 'dcName' risk_score:50 security_domain:endpoint
