Group Policy object rewritten in its code path or its permissions

Siemphony@siemphonymediumT1484.001unverified

AN0854 covers both halves of a malicious GPO change — the directory object edit that repoints or extends a policy, and the delegation edit that hands someone the right to make it — and Security EventID 5136 is the one source in the brief that records either directly. The rule gates on a directory object modification whose ObjectClass is groupPolicyContainer, then requires the changed attribute to be one of four that determine what a policy does or who may change it: gPCFileSysPath, the SYSVOL path clients read policy from; gPCMachineExtensionNames and gPCUserExtensionNames, the client-side extension lists that decide which processors run — the pair a scheduled-task or registry payload has to touch; and nTSecurityDescriptor, the GPO's own ACL. That attribute list is authored into MITRE's `ObjectDN` and `UserContext` knobs, not taken from MITRE. The SYSVOL file leg is deliberately not attempted: on a domain controller those writes arrive over SMB from a management console, so Sysmon EventID 11 records the System process rather than the editing tool, and MITRE's `TimeWindow` correlation between the object change and the file write is a cross-event join Sigma cannot express. Note also that the brief maps Security 4663 onto the Sysmon-shaped `file_event` category, whose TargetFilename field 4663 does not have, so that feed would need a field mapping before any file-based variant of this rule could match. Prerequisite: 5136 needs the *Audit Directory Service Changes* subcategory enabled on domain controllers and an auditing SACL covering the Policies container — neither is on in a default install or in the Microsoft and CIS baselines, so an empty result means blind rather than quiet. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0305, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

SecurityEvent| where ((EventID == 5136 and ObjectClass =~ "groupPolicyContainer") and (AttributeLDAPDisplayName =~ "gPCFileSysPath" or AttributeLDAPDisplayName =~ "gPCMachineExtensionNames" or AttributeLDAPDisplayName =~ "gPCUserExtensionNames" or AttributeLDAPDisplayName =~ "nTSecurityDescriptor"))

Splunk · SPL

Run this as a search.

index=* ((EventID="5136" AND ObjectClass="groupPolicyContainer") AND (AttributeLDAPDisplayName="gPCFileSysPath" OR AttributeLDAPDisplayName="gPCMachineExtensionNames" OR AttributeLDAPDisplayName="gPCUserExtensionNames" OR AttributeLDAPDisplayName="nTSecurityDescriptor"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((event.code == 5136 AND TO_LOWER(ObjectClass) == "grouppolicycontainer") AND (TO_LOWER(AttributeLDAPDisplayName) == "gpcfilesyspath" OR TO_LOWER(AttributeLDAPDisplayName) == "gpcmachineextensionnames" OR TO_LOWER(AttributeLDAPDisplayName) == "gpcuserextensionnames" OR TO_LOWER(AttributeLDAPDisplayName) == "ntsecuritydescriptor"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^5136$</field>    <field name="ObjectClass" type="pcre2">(?i)^groupPolicyContainer$</field>    <field name="AttributeLDAPDisplayName" type="pcre2">(?i)(^gPCFileSysPath$|^gPCMachineExtensionNames$|^gPCUserExtensionNames$|^nTSecurityDescriptor$)</field>    <description>Group Policy object rewritten in its code path or its permissions</description>    <mitre>      <id>T1484.001</id>    </mitre>  </rule></group>

At a glance

Logsource: security / windows
Level: medium
Category: directory_object_tampering
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 8370ca90-880c-49e1-b782-16600ce02658

ATT&CKT1484.001

T1484.001Group Policy Modification

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondirectory object tampering

directory object tamperingAI draft — unreviewed

01 · What this rule detects

AN0854 covers malicious GPO change made through LDAP, ADSI, PowerShell or the GUI. Security EventID 5136 is the one source in the brief that records a directory object change directly, and this rule uses only that. It fires when a groupPolicyContainer object has one of four attributes modified — the attributes that decide what a policy does, or who is allowed to change it.

02 · Telemetry you need

product: windows / service: security, verbatim from the brief's 5136 source. 5136 is off in a default install and in the Microsoft and CIS baselines. It needs Audit Directory Service Changes on domain controllers and an auditing SACL granting Write Property on descendant groupPolicyContainer objects in the Policies container. Confirm nTSecurityDescriptor writes are covered separately: the commonly deployed "write all properties" entry does not always include them, and a partly configured SACL leaves the ACL branch silent — blind reading as quiet.
The SYSVOL file leg is deliberately not attempted: on a DC those writes arrive over SMB, so Sysmon EventID 11 records the System process rather than the editing tool. The brief also maps Security 4663 onto the Sysmon-shaped file_event category, which expects TargetFilename — 4663 has no such field, so that feed needs a mapping before any file-based variant could match. The 4704 source is unused, which means AN0854's SeEnableDelegationPrivilege element is not covered here at all.

03 · How the logic works

Two blocks, ANDed. selection_object pins EventID: 5136 and ObjectClass: 'groupPolicyContainer'. selection_attribute requires AttributeLDAPDisplayName to be one of four exact values. Those four are authored outright. MITRE's knobs on this analytic are ObjectDN (the container DN) and UserContext (the acting account); neither is an attribute-name knob, so nothing in the list came from MITRE. gPCFileSysPath is the SYSVOL path clients read policy from — repoint it and the policy's code moves. gPCMachineExtensionNames and gPCUserExtensionNames are the client-side-extension GUID lists that decide which processors run. nTSecurityDescriptor is the GPO's own ACL, the delegation half. The blind spot sits in the extension lists. They are rewritten when the set of extensions changes, not when a setting inside an already-registered extension is edited. An adversary who picks a GPO that already carries Group Policy Preferences Scheduled Tasks writes ScheduledTasks.xml into SYSVOL, bumps versionNumber, and this rule never sees it — the stealthiest form of the technique, and the usual advice.

04 · Common false positives

Every GPO edit that adds or removes a policy area rewrites an extension list, so ordinary console administration matches — though not, for the reason above, every edit. Absolute volume stays low because GPO edits are infrequent, which is why the level is medium rather than high.
Then: delegation to helpdesk or build teams and ACL remediation projects, which rewrite nTSecurityDescriptor; baseline and co-management products that own GPOs under a service account; and backup, restore and migration tooling, which rewrites gPCFileSysPath wholesale.
One artefact to expect: 5136 emits a Value Deleted / Value Added pair per attribute change, so a single edit produces at least two matches and a multi-attribute edit several. With no OperationType gate, that burst can read as repeated tampering.

05 · Detection maturity

tier_1: , and it cannot leave until it has been run against real 5136 data. Nothing here has been executed; the noise ordering above is inference from attribute semantics, not measurement.
tier_2: enable the SACL, run read-only for a full change cycle, and tabulate hits by `SubjectUserName` and by attribute.
tier_3: ** correlate the object change with the SYSVOL file write inside MITRE's TimeWindow, and add the 4704 leg, so both halves AN0854 describes are covered instead of one.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add OperationType to selection_object so one edit reads as one event.
Use MITRE's ObjectDN knob as intended and constrain to
Then use UserContext. Alerting on modification by accounts outside your named
Consider versionNumber as a fifth attribute to close the blind spot above,

Declared by the author

Routine Group Policy administration. Adding or removing any setting that is backed by a client-side extension rewrites gPCMachineExtensionNames or gPCUserExtensionNames, so every ordinary policy edit made through the Group Policy Management Console matches. Absolute volume is low because GPO edits are infrequent, but the proportion matching is close to all of them, which is why this is medium and not high.
Delegation of policy editing to a helpdesk, application or server-build team, which rewrites nTSecurityDescriptor on each affected GPO, as does any periodic ACL remediation or tiering project.
Configuration and compliance products that own GPOs under a service account — security-baseline tooling, patch and update managers, and co-management agents that create, update or version policies on a schedule.
GPO backup, restore, migration and import operations, and domain migration tooling, all of which rewrite gPCFileSysPath and the extension lists on the policies they touch.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1484.001, evaluated against their — events.

Share this rule

/u/siemphony/8370ca90-880c-49e1-b782-16600ce02658

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Group Policy object rewritten in its code path or its permissions

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it