attack.t1484.001

Group Policy Abuse for Privilege Addition

Apr 28, 2026 · attack.privilege-escalation attack.defense-impairment attack.t1484.001 ·

Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins.

Modify Group Policy Settings

Apr 28, 2026 · attack.privilege-escalation attack.defense-impairment attack.t1484.001 ·

Share on:

Detect malicious GPO modifications can be used to implement many other malicious behaviors.

Modify Group Policy Settings - ScriptBlockLogging

Apr 28, 2026 · attack.privilege-escalation attack.defense-impairment attack.t1484.001 ·

Share on:

Detect malicious GPO modifications can be used to implement many other malicious behaviors.

Startup/Logon Script Added to Group Policy Object

Apr 28, 2026 · attack.persistence attack.privilege-escalation attack.defense-impairment attack.t1484.001 attack.t1547 ·

Share on:

Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.

Windows Default Domain GPO Modification

Apr 28, 2026 · attack.privilege-escalation attack.defense-impairment attack.t1484.001 ·

Share on:

Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may modify these default GPOs to deploy malicious configurations across the domain.

Windows Default Domain GPO Modification via GPME

Apr 28, 2026 · attack.privilege-escalation attack.defense-impairment attack.t1484.001 ·

Share on:

Detects the use of the Group Policy Management Editor (GPME) to modify Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may leverage GPME to make stealthy changes in these default GPOs to deploy malicious GPOs configurations across the domain without raising suspicion.