T1484.001sub-technique of T1484 Domain or Tenant Policy Modification
Group Policy Modification
Windows1 piece on this siteT1484.001 on attack.mitre.org
Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain. Group policy allows for centralized management of user and computer settings in Active Directory (AD). GPOs are containers for group policy settings made up of files stored within a predictable network path `\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\`.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Domain-level access you cannot account for
An unexplained Domain Admin, directory replication by something that is not a domain controller, or a ticket that does not match any authentication.
how MITRE says to see it
Detection of Group Policy Modifications via AD Object Changes and File Activity
- Adversary modifies GPO containers or files under SYSVOL using LDAP, ADSI, PowerShell (e.g., New-GPOImmediateTask) or GUI tools. This includes directory object changes (e.g., gPCFileSysPath), delegation assignments (SeEnableDelegationPrivilege), and SYSVOL file writes (ScheduledTasks.xml, GptTmpl.inf).
what reduces it
- M1018 User Account Management. Consider implementing WMI and security filtering to further tailor which users and computers a GPO will apply to.
- M1047 Audit. Identify and correct GPO permissions abuse opportunities (ex: GPO modification privileges) using auditing tools such as BloodHound (version 1.5.1 and later).