Techniques
Sample rules
Windows Group Policy Object Created
- source: splunk
- technicques:
- T1484
- T1484.001
- T1078.002
Description
The following analytic detects the creation of a new Group Policy Object (GPO) by leveraging Event IDs 5136 and 5137. This detection uses directory service change events to identify when a new GPO is created. Monitoring GPO creation is crucial as adversaries can exploit GPOs to escalate privileges or deploy malware across an Active Directory network. If confirmed malicious, this activity could allow attackers to control system configurations, deploy ransomware, or propagate malware, leading to widespread compromise and significant operational disruption.
Detection logic
`wineventlog_security` EventCode=5137 OR (EventCode=5136 AttributeValue!="New Group Policy Object" AND (AttributeLDAPDisplayName=displayName OR AttributeLDAPDisplayName=gPCFileSysPath) ) ObjectClass=groupPolicyContainer
| stats values(AttributeValue) as details values(SubjectUserSid) as User values(ObjectDN) as ObjectDN by ObjectGUID Computer
| eval GPO_Name = mvindex(details, 0)
| eval GPO_Path = mvindex(details, 1)
| fields - details
| `windows_group_policy_object_created_filter`
Windows Admon Group Policy Object Created
- source: splunk
- technicques:
- T1484
- T1484.001
Description
The following analytic detects the creation of a new Group Policy Object (GPO) using Splunk’s Admon data. It identifies events where a new GPO is created, excluding default “New Group Policy Object” entries. Monitoring GPO creation is crucial as adversaries can exploit GPOs to escalate privileges or deploy malware across an Active Directory network. If confirmed malicious, this activity could allow attackers to control system configurations, deploy ransomware, or propagate malware, significantly compromising the network’s security.
Detection logic
`admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*" versionNumber=0 displayName!="New Group Policy Object"
| stats min(_time) as firstTime max(_time) as lastTime values(gPCFileSysPath) by dcName, displayName
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_admon_group_policy_object_created_filter`