Modify Group Policy Settings

Title: Modify Group Policy Settings
Status: test
Description:Detect malicious GPO modifications can be used to implement many other malicious behaviors.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1484.001/T1484.001.md
Author: frack113
Date: 2022-08-19
modified:None
Tags:

• -'attack.privilege-escalation'
• -'attack.defense-impairment'
• -'attack.t1484.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_reg:
Image|endswith:'\reg.exe' OriginalFileName:'reg.exe'   selection_path:
    CommandLine|contains: '\SOFTWARE\Policies\Microsoft\Windows\System'
  selection_key:
    CommandLine|contains:
      -'GroupPolicyRefreshTimeDC'
      -'GroupPolicyRefreshTimeOffsetDC'
      -'GroupPolicyRefreshTime'
      -'GroupPolicyRefreshTimeOffset'
      -'EnableSmartScreen'
      -'ShellSmartScreenLevel'

  condition:all of selection_*
Falsepositives:
  -Legitimate use
Level: medium