Query: Sigma rule for Detect malicious GPO modifications can be used to implement many other malicious behaviors.
Matching passage: Sigma rule: Detect malicious GPO modifications can be used to implement many other malicious behaviors.. Logsource: windows / ps_script. Rule: title: Modify Group Policy Settings - ScriptBlockLogging id: b7216a7d-687e-4c8d-82b1-3080b2ad961f related: - id: ada4b0c4-758b-46ac-9033-9004613a150d type: similar status: test description: Detect malicious GPO modifications can be used to implement many other malicious behaviors. references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1484.001/T1484.001.md author: frack113 date: 2022-08-19 tags: - attack.privilege-escalation - attack.defense-impairment - attack.t1484.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_path: ScriptBlockText|contains: \SOFTWARE\Policies\Microsoft\Windows\System selection_key: ScriptBlockText|contains: - GroupPolicyRefreshTimeDC - GroupPolicyRefreshTimeOffsetDC - GroupPolicyRefreshTime - GroupPolicyRefreshTimeOffset - EnableSmartScreen - ShellSmartScreenLevel condition: all of selection_* falsepositives: - Legitimate use level: medium
Near-miss passage: Sigma rule: Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology fo. Logsource: windows / system. Rule: title: ISATAP Router Address Was Set id: d22df9cd-2aee-4089-93c7-9dc4eae77f2c status: experimental description: 'Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6. In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic. This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment. ' references: - https://www.blackhillsinfosec.com/mitm6-strikes-again-the-dark-side-of-ipv6/ - https://redfoxsec.com/blog/ipv6-dns-takeover/ - https://www.securityhq.com/blog/malicious-isatap-tunneling-unearthed-on-windows-server/ - https://medium.com/@ninnesoturan/detecting-ipv6-dns-takeover-a54a6a88be1f author: hamid date: 2025-10-19 tags: - attack.impact - attack.credential-access - attack.collection - attack.initial-access - attack.privilege-escalation - attack.execution - attack.t1557 - attack.t1565.002 logsource: product: windows service: system detection: selection: EventID: 4100 Provider_Name: Microsoft-Windows-Iphlpsvc filter_main_localhost: IsatapRouter: - 127.0.0.1 - ::1 filter_optional_null: IsatapRouter: null condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate ISATAP router configuration in enterprise environments - IPv6 transition projects and network infrastructure changes - Network administrators configuring dual-stack networking - Automatic ISATAP configuration in some Windows deployments level: medium