Windows Default Domain GPO Modification

calendar Nov 23, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1484.001  ·
Share on: linkedin copy

Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may modify these default GPOs to deploy malicious configurations across the domain.

Sigma rule (View on GitHub)

 1title: Windows Default Domain GPO Modification
 2id: e5ac86dd-2da1-454b-be74-05d26c769d7d
 3related:
 4    - id: dcff7e85-d01f-4eb5-badd-84e2e6be8294
 5      type: similar
 6status: experimental
 7description: |
 8    Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs).
 9    Adversaries may modify these default GPOs to deploy malicious configurations across the domain.    
10references:
11    - https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html
12    - https://adsecurity.org/?p=3377
13    - https://www.pentestpartners.com/security-blog/living-off-the-land-gpo-style/
14    - https://jgspiers.com/audit-group-policy-changes/
15author: Swachchhanda Shrawan Poudel (Nextron Systems)
16date: 2025-11-22
17tags:
18    - attack.defense-evasion
19    - attack.privilege-escalation
20    - attack.t1484.001
21logsource:
22    product: windows
23    service: security
24    definition: |
25        Enable 'Audit Directory Service Changes' in the Default Domain Controllers Policy under:
26        Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> Audit Policies -> DS Access -> Audit Directory Service Changes (Success).
27        Additionally, proper SACL needs to be configured on the 'CN=Policies,CN=System,DC=<domain>,DC=<tld>' container in Active Directory to capture changes to Group Policy Objects.        
28detection:
29    selection:
30        EventID: 5136
31        ObjectClass: 'groupPolicyContainer'
32        ObjectDN|startswith:
33            - 'CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM' # Default Domain Policy
34            - 'CN={6AC1786C-016F-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM' # Default Domain Controllers Policy
35    condition: selection
36falsepositives:
37    - Legitimate modifications to Default Domain or Default Domain Controllers GPOs
38level: medium

References

Related rules

to-top