Domain or Tenant Policy Modification: Group Policy Modification
Process Modify GroupPolicy — Modify the Group Policy that a domain applies to a scope of computers or users — by editing a linked Group Policy Object's directory container or its SYSVOL template, or by linking a GPO to a site, domain, or OU — so that domain members apply attacker-chosen configuration.
Detect
activity_id = Update with managed_entity.type = Policy and policy.type = Group Policy is technique-defining. Every GPO edit and every link change is an update to the domain's Group Policy, whichever tool, account, GPO name, or scope the attacker chooses. The practical rating is lower wherever native telemetry does not cover all three surfaces: Directory Service Changes auditing is off by default, 5136 needs SACLs on groupPolicyContainer objects and on the containers carrying gPLink, and SYSVOL template writes need file auditing or FIM on the DCs. An attacker who edits only the SYSVOL template of an already-linked GPO never generates a 5136.
Enable Audit Directory Service Changes on all DCs, with SACLs auditing writes to groupPolicyContainer objects and to gPLink/gPOptions on the domain root, OUs, and sites. Add file integrity monitoring on SYSVOL\Policies\. Normalise all three into one Group Policy update event and alert on any update outside a change window, treating link changes at the domain root as highest severity. A rule on gPLink at the domain root alone (5136, ObjectClass domainDNS) is a narrower STP 5 rule: it constrains the scope, not the medium, and misses edits to GPOs that are already linked, such as the Default Domain Policy. On endpoints, a sudden change of GPO version across many hosts is a useful corroborating signal, but it only sees the effect of the change.
Mitigate
Restricting who can edit GPOs, write gPLink, or write to SYSVOL operates on the artifact itself, but like autostart-key ACLs it does not block an attacker who already holds those rights, and in PAYLOAD's case a single compromised domain credential was enough. No high-STP mitigation exists at the artifact: Group Policy is designed to let privileged accounts push arbitrary configuration to every member, so detection on the DC is the primary defensive lever.
d3f:SystemConfigurationPermissionsNo STP 5 mitigation exists. Detection is the primary defensive lever.
Treat GPO edit and link rights as Tier 0. Audit and prune delegated GPO permissions and the Group Policy Creator Owners group, remove non-Tier-0 write ACEs on gPLink at the domain root and on privileged OUs, and lock down SYSVOL ACLs. Keep GPO backups (Backup-GPO) so that affected GPOs can be restored and rogue links removed quickly. The upstream controls matter most: keep Tier 0 credentials off VPN and workstation logons so that the rights needed for this technique are harder to obtain.
Respond
An existing artifact was changed and remains in use in its altered state. Revert or restore from backup. Investigate all actions taken using the modified permissions or configuration.
actor.processactor.userd3f:ProcessTerminationd3f:AccountLockingd3f:CredentialRevokingd3f:NetworkIsolationOCSF event model▼
Event class: Entity Management (3004) ↗
· activity_id: Update
%%{init: {"theme": "dark", "themeVariables": {"edgeLabelBackground": "#18181b", "lineColor": "#52525b"}}}%%
graph TD
classDef attacker fill:#7c2d12,stroke:#ea580c,color:#fed7aa
classDef victim fill:#1e3a5f,stroke:#3b82f6,color:#bfdbfe
classDef postSuccess fill:#78350f,stroke:#d97706,color:#fde68a
classDef tainted fill:#18181b,stroke:#52525b,color:#a1a1aa
EVENT(["Entity Management\n· Update"])
actor_process["Writing Process\nactor.process\nd3f:Process"]:::attacker
actor_user["GPO-Editing Account\nactor.user\nd3f:UserAccount"]:::attacker
group_policy["Group Policy\nmanaged_entity\nd3f:GroupPolicy"]:::victim
device["Domain Controller\ndevice\nd3f:Host\n⚠ tainted"]:::tainted
EVENT --> actor_process
actor_process --> actor_user
EVENT --> group_policy
EVENT --> device
actor_process -.->|"modifies"| group_policyactor.process·d3f:Processactor.process.file.path | attacker_controlled | Tool performing the LDAP/SMB write (GPMC, PowerShell, SharpGPOAbuse, a remote Python client) — Execution Medium, attacker-chosen. Often not observable at all: the write arrives at the DC over the network from a host the defender may not monitor |
d3f:ProcessTerminationactor.user·d3f:UserAccountactor.user.name | attacker_controlled | Account holding GPO edit or link rights (Domain Admins, Group Policy Creator Owners, or a delegated principal) — attacker-chosen from the credentials available |
d3f:AccountLockingd3f:CredentialRevokingmanaged_entity·d3f:GroupPolicymanaged_entity.type | invariant | = Policy |
managed_entity.policy.type | invariant | = Group Policy |
managed_entity.uid | variable | GPO GUID — assigned by the directory when the GPO is created, not chosen by the attacker |
managed_entity.name | attacker_controlled | GPO display name — freely set when the attacker creates a new GPO (PAYLOAD used "PAYLOAD" and "win Firewall Off"); victim-side when an existing GPO is edited |
managed_entity.group.name | variable | Scope the policy applies to (site, domain root, or OU). The attacker picks it from a victim-defined set, and the choice sets the blast radius: the domain root reaches every member |
d3f:SystemConfigurationPermissionsdevice·d3f:Hostd3f:NetworkIsolationDefinitional Sigma rule▼
Broad by design — defines the technique, not an operational alert. Gate on variable or attacker-controlled field conditions to narrow for production use.
managed_entity.policy.type → extension proposal ↗
title: Domain or Tenant Policy Modification: Group Policy Modification (T1484.001)
status: experimental
description: >
Definitional rule — broad by design. Defines the technique independent of
medium, tool, or attacker-controlled variables. Narrow with variable and
attacker-controlled field conditions for operational use.
logsource:
product: ocsf
category: Entity Management (3004)
detection:
selection:
activity_id: 'Update'
managed_entity.type: 'Policy'
managed_entity.policy.type: 'Group Policy'
condition: selectionExecution Medium–scoped detectionSTP 3 ceiling▼
Sample rules — not canonical definitions. Each constrains detection to a specific Execution Medium and has a hard STP 3 ceiling. The attacker switches Execution Medium; the rule misses. Compare with the definitional rule above.
Gating on the GroupPolicy module's cmdlet names has a hard STP 3 ceiling. It is evaded by GPMC, SharpGPOAbuse, or raw LDAP/SMB writes, and entirely by pyGPOAbuse run from a non-domain host, which generates no process event on any monitored machine. The Group Policy update on the DC is unchanged in every case.
title: Group Policy Modification — PowerShell GroupPolicy module medium (sample)
status: experimental
description: >
Sample — STP 3 ceiling. Detects PowerShell invoking GroupPolicy module
cmdlets that create, link, or edit a GPO. Evaded by switching to GPMC,
SharpGPOAbuse, pyGPOAbuse from a non-domain host, or direct LDAP/SMB writes.
logsource:
product: ocsf
category: Process Activity (1007)
detection:
selection_img:
process.file.name:
- 'powershell.exe'
- 'pwsh.exe'
selection_cmdlet:
process.cmd_line|contains:
- 'New-GPLink'
- 'Set-GPLink'
- 'Set-GPRegistryValue'
- 'Set-GPPrefRegistryValue'
- 'Import-GPO'
condition: all of selection_*Seen in the wild1report▼
PAYLOAD operators created two GPOs and linked them at the domain root, writing gPLink on the domainDNS object. The linked GPOs pushed ransom notes, a logon banner, a local Administrator disable, and a firewall kill switch to every domain member without encrypting any Windows host.