Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
126 detections
Filters
Last updated
All Time
Detection languages
56
31
17
8
4
Contributors
34
24
15
15
9
Categories
83
49
27
27
17
Platforms
109
17
13
1
1
Products / Services
79
66
18
16
9
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
IDS Classtypes
2
1
IDS Protocols
3
Detects Play-style lateral movement via Group Policy: an executable (.exe/.dll) written to a SYSVOL/GPO path by the same non-machine account that modified a GPO in the same 30-minute window. Attackers use this to push ransomware or Cobalt Strike/SystemBC payloads domain-wide.
Detects Play-style lateral movement via Group Policy: an executable (.exe/.dll) written to a SYSVOL/GPO path by the same non-machine account that modified a GPO in the same 30-minute window. Attackers use this to push ransomware or Cobalt Strike/SystemBC payloads domain-wide.
This detection identifies when a a new client side extension is added to an Active Directory Group Policy using the Group Policy Management Console.
Detects modifications to Windows Registry keys responsible for the legal notice caption and text displayed at logon. Adversaries may abuse Group Policy Objects (GPOs) to set these values to ransom-themed messages, a technique sometimes observed in ransomware campaigns to signal compromise to users.
Detects the disabling of the built-in 'Administrator' account initiated by a system-level process (e.g., service or background task), which is characteristic of GPO enforcement or malicious tampering.
Detects the creation of new Group Policy Objects (GPOs), linking of GPOs at the domain root level, or modifications to existing GPOs that include 'Firewall' in their configuration settings. These activities are common precursors or indicators of persistence mechanisms and defensive bypass attempts by adversaries seeking to weaken security controls or maintain unauthorized access.
Detects modifications or deletions of Azure AD Conditional Access policies that weaken security, such as disabling policies, removing MFA requirements, or adding user/group/application exclusions. This behavior can be indicative of an attacker attempting to bypass authentication controls.
This rule detects modifications to Group Policy Objects (GPOs) that are either explicitly marked as malicious based on known indicators (GUIDs or 'PAYLOAD' strings) or involve unauthorized modifications to domain-root or organizational unit GPO links. It monitors Active Directory security event logs for object changes.
This rule detects scenarios where a user account modifies Conditional Access (CA) policies (specifically targeting user or group inclusion/exclusion settings) within one hour of that same user account modifying authentication method policies. This pattern is potentially indicative of an adversary weakening security controls by adjusting authentication requirements and subsequently tampering with CA policies to maintain persistence or bypass MFA.
Detects a significant number of endpoints processing Group Policy computer configurations within a short time window. This activity is indicative of a synchronized event, such as a domain-wide application of a newly modified or deployed Group Policy Object (GPO), which may follow a 'time-bomb' malicious GPO detonation or unauthorized policy change.
Detects lateral movement activities associated with The Gentlemen ransomware group. The rule monitors for the execution of PowerShell scripts named 'deploy_gpo.ps1' from the %TEMP% directory, PowerShell interactions with the NETLOGON share for malware distribution, creation of ScheduledTasks.xml via PowerShell (a common GPO manipulation technique), and the subsequent enforcement of policy changes using 'gpupdate /force' invoked by scripting engines.
Detects modifications or deletions of Azure AD Conditional Access policies that weaken security, such as disabling policies, removing MFA requirements, or adding user/group/application exclusions. This behavior can be indicative of an attacker attempting to bypass authentication controls.
Detects modifications to Group Policy Objects (GPOs) or GPO links in Active Directory, specifically targeting known malicious GPO identifiers, GPO payloads, or changes to policy versioning and linking that indicate unauthorized configuration changes for persistence or privilege escalation.
Detects changes to the Access Control List (ACL) of the AdminSDHolder object in Active Directory. AdminSDHolder is a protected object whose ACL is automatically propagated by the SDProp process every 60 minutes to all privileged groups and accounts in the domain. Modifying the ACL on this object allows an adversary to establish a durable, self-healing backdoor by granting persistent access to high-privileged security principals.
Detects suspicious file create or write operations within the domain SYSVOL Policies directory. This pattern is commonly associated with attackers attempting to deploy malicious payloads, such as ransom notes or configuration changes, via Group Policy Objects (GPO). The rule monitors Windows Event ID 4663 to identify unauthorized modification attempts by non-system accounts.
Detects a suspicious pattern across the environment where a large number of devices apply Group Policy Objects (GPO) shortly after rebooting. This behavior is indicative of potential unauthorized GPO modification used as a persistence or execution mechanism, where malicious logic is staged within a GPO to trigger across the domain upon machine startup.
This rule detects the deployment of suspicious executables or scripts (e.g., .exe, .bat, .ps1, .vbs) via Group Policy (GPO) paths or through GPO-related processes like gpscript.exe and gpupdate.exe. This activity is consistent with using GPOs to distribute and execute malicious binaries across a domain, often a precursor to ransomware deployment.
Detects unauthorized modifications to Group Policy Objects (GPO) involving critical attributes (such as SYSVOL paths or extension configurations) combined with the creation of new script or executable files in the SYSVOL Scripts folder. This behavior is indicative of potential GPO tampering to gain persistence or facilitate large-scale execution, such as ransomware deployment via GPOs.
Detects lateral movement activities associated with The Gentlemen ransomware group. The rule monitors for the execution of PowerShell scripts named 'deploy_gpo.ps1' from the %TEMP% directory, PowerShell interactions with the NETLOGON share for malware distribution, creation of ScheduledTasks.xml via PowerShell (a common GPO manipulation technique), and the subsequent enforcement of policy changes using 'gpupdate /force' invoked by scripting engines.
This rule detects modifications to Group Policy Objects (GPOs) that are either explicitly marked as malicious based on known indicators (GUIDs or 'PAYLOAD' strings) or involve unauthorized modifications to domain-root or organizational unit GPO links. It monitors Active Directory security event logs for object changes.
Detects unauthorized creation, modification, or deletion of Group Policy Objects (GPOs) at the Active Directory domain root. This activity is a high-confidence indicator of potential persistence or domain-wide configuration tampering, often observed during ransomware attacks or privilege escalation attempts where attackers weaponize Group Policy.
Page 1 of 6