Windows Default Domain GPO Modification

Title: Windows Default Domain GPO Modification
Status: experimental
Description:Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may modify these default GPOs to deploy malicious configurations across the domain.
References:
  -https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html
  -https://adsecurity.org/?p=3377
  -https://www.pentestpartners.com/security-blog/living-off-the-land-gpo-style/
  -https://jgspiers.com/audit-group-policy-changes/
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-22
modified:None
Tags:

• -'attack.privilege-escalation'
• -'attack.defense-impairment'
• -'attack.t1484.001'

Logsource:

• product: windows
• service: security
• definition: Enable 'Audit Directory Service Changes' in the Default Domain Controllers Policy under: Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> Audit Policies -> DS Access -> Audit Directory Service Changes (Success). Additionally, proper SACL needs to be configured on the 'CN=Policies,CN=System,DC=<domain>,DC=<tld>' container in Active Directory to capture changes to Group Policy Objects.

Detection:
  selection:
    EventID: '5136'
    ObjectClass: 'groupPolicyContainer'
    ObjectDN|startswith:
      -'CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM'
      -'CN={6AC1786C-016F-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM'

  condition:selection
Falsepositives:
  -Legitimate modifications to Default Domain or Default Domain Controllers GPOs
Level: medium