Group Policy object rewritten in its code path or its permissions

1title: Group Policy object rewritten in its code path or its permissions2id: 8370ca90-880c-49e1-b782-16600ce026583status: experimental4description: |5  AN0854 covers both halves of a malicious GPO change — the directory object6  edit that repoints or extends a policy, and the delegation edit that hands7  someone the right to make it — and Security EventID 5136 is the one source in8  the brief that records either directly. The rule gates on a directory object9  modification whose ObjectClass is groupPolicyContainer, then requires the10  changed attribute to be one of four that determine what a policy does or who11  may change it: gPCFileSysPath, the SYSVOL path clients read policy from;12  gPCMachineExtensionNames and gPCUserExtensionNames, the client-side extension13  lists that decide which processors run — the pair a scheduled-task or registry14  payload has to touch; and nTSecurityDescriptor, the GPO's own ACL. That15  attribute list is authored into MITRE's `ObjectDN` and `UserContext` knobs,16  not taken from MITRE. The SYSVOL file leg is deliberately not attempted: on a17  domain controller those writes arrive over SMB from a management console, so18  Sysmon EventID 11 records the System process rather than the editing tool, and19  MITRE's `TimeWindow` correlation between the object change and the file write20  is a cross-event join Sigma cannot express. Note also that the brief maps21  Security 4663 onto the Sysmon-shaped `file_event` category, whose22  TargetFilename field 4663 does not have, so that feed would need a field23  mapping before any file-based variant of this rule could match. Prerequisite:24  5136 needs the *Audit Directory Service Changes* subcategory enabled on domain25  controllers and an auditing SACL covering the Policies container — neither is26  on in a default install or in the Microsoft and CIS baselines, so an empty27  result means blind rather than quiet.28  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0305, not hand-written and not tested by its author. Any lab result is on this rule's own page.29references:30  - https://attack.mitre.org/techniques/T1484/00131  - https://attack.mitre.org/detectionstrategies/DET030532author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)33date: 2026-08-1634tags:35  - attack.defense-evasion36  - attack.privilege-escalation37  - attack.t1484.00138logsource:39  product: windows40  service: security41detection:42  selection_object:43    EventID: 513644    ObjectClass: 'groupPolicyContainer'45  selection_attribute:46    AttributeLDAPDisplayName:47      - 'gPCFileSysPath'48      - 'gPCMachineExtensionNames'49      - 'gPCUserExtensionNames'50      - 'nTSecurityDescriptor'51  condition: selection_object and selection_attribute52falsepositives:53  - "Routine Group Policy administration. Adding or removing any setting that is backed by a client-side extension rewrites gPCMachineExtensionNames or gPCUserExtensionNames, so every ordinary policy edit made through the Group Policy Management Console matches. Absolute volume is low because GPO edits are infrequent, but the proportion matching is close to all of them, which is why this is medium and not high."54  - "Delegation of policy editing to a helpdesk, application or server-build team, which rewrites nTSecurityDescriptor on each affected GPO, as does any periodic ACL remediation or tiering project."55  - "Configuration and compliance products that own GPOs under a service account — security-baseline tooling, patch and update managers, and co-management agents that create, update or version policies on a schedule."56  - "GPO backup, restore, migration and import operations, and domain migration tooling, all of which rewrite gPCFileSysPath and the extension lists on the policies they touch."57level: medium