Query: detect Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may modif in logs
Matching passage: Sigma rule: Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may modif. Logsource: windows / security. Rule: title: Windows Default Domain GPO Modification id: e5ac86dd-2da1-454b-be74-05d26c769d7d related: - id: dcff7e85-d01f-4eb5-badd-84e2e6be8294 type: similar status: experimental description: 'Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may modify these default GPOs to deploy malicious configurations across the domain. ' references: - https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html - https://adsecurity.org/?p=3377 - https://www.pentestpartners.com/security-blog/living-off-the-land-gpo-style/ - https://jgspiers.com/audit-group-policy-changes/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-22 tags: - attack.privilege-escalation - attack.defense-impairment - attack.t1484.001 logsource: product: windows service: security definition: 'Enable ''Audit Directory Service Changes'' in the Default Domain Controllers Policy under: Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> Audit Policies -> DS Access -> Audit Directory Service Changes (Success). Additionally, proper SACL needs to be configured on the ''CN=Policies,CN=System,DC=<domain>,DC=<tld>'' container in Active Directory to capture changes to Group Policy Objects. ' detection: selection: EventID: 5136 ObjectClass: groupPolicyContainer ObjectDN|startswith: - CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM - CN={6AC1786C-016F-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM condition: selection falsepositives: - Legitimate modifications to Default Domain or Default Domain Controllers GPOs level: medium
Near-miss passage: Sigma rule: Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted id: 25cb259b-bbdc-4b87-98b7-90d7c72f8743 status: test description: Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/ - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1 author: Austin Songer @austinsonger date: 2021-08-07 modified: 2022-08-23 tags: - attack.impact - attack.credential-access - attack.t1485 - attack.t1496 - attack.t1489 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLEBINDINGS/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLEBINDINGS/DELETE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLEBINDINGS/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLEBINDINGS/DELETE condition: selection falsepositives: - RoleBinding/ClusterRoleBinding being modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - RoleBinding/ClusterRoleBinding modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium