Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
126 detections
Filters
Last updated
All Time
Detection languages
56
31
17
8
4
Contributors
34
24
15
15
9
Categories
83
49
27
27
17
Platforms
109
17
13
1
1
Products / Services
79
66
18
16
9
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
2
1
IDS Protocols
3
This rule detects potential abuse of Group Policy Objects (GPOs) by identifying multiple changes (3 or more) to GPO-related objects within a short timeframe. It specifically looks for Event ID 5136 (Directory Service Changes) where the ObjectClass is either 'groupPolicyContainer' or 'gPCFileSysPath'. This could indicate an adversary modifying GPOs to achieve persistence, privilege escalation, or other malicious objectives.
This rule detects attempts to modify Group Policy Objects (GPOs) over Server Message Block (SMB) by looking for HTTP PUT requests containing '\SYSVOL\' and '\Policies\' in the URI. This activity can indicate an adversary attempting to escalate privileges or establish persistence within an Active Directory domain.
Detects the creation or modification of a ScheduledTasks.xml file within the SYSVOL directory, indicative of automated task deployment via Group Policy Preferences (GPP) commonly abused by adversaries. This activity can be used for persistence, privilege escalation, or lateral movement.
Detects the creation or modification of a ScheduledTasks.xml file within the SYSVOL directory. This behavior indicates automated task deployment via Group Policy Preferences (GPP), a technique observed in The Gentlemen RaaS and other operations to simultaneously execute ransomware or other payloads across domain-joined computers.
Detects the use of the Group Policy Management Editor (GPME) to modify Default Domain or Default Domain Controllers Group Policy Objects (GPOs).
Adversaries may leverage GPME to make stealthy changes in these default GPOs to deploy malicious GPOs configurations across the domain without raising suspicion.
Adversaries may leverage GPME to make stealthy changes in these default GPOs to deploy malicious GPOs configurations across the domain without raising suspicion.
Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins.
Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs).
Adversaries may modify these default GPOs to deploy malicious configurations across the domain.
Adversaries may modify these default GPOs to deploy malicious configurations across the domain.
Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.
Detects potential suspicious behavior using secedit.exe, specifically when it is used to export or configure security policies. This could indicate an adversary attempting to discover system configurations or modify them for persistence, defense evasion, or privilege escalation.
Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects. This can be used by adversaries for persistence, privilege escalation, or defense evasion.
Detects the creation or modification of scheduled tasks via Group Policy Objects (GPO), which can be used by adversaries for persistence, execution, and lateral movement, often seen in ransomware deployment scenarios. The rule specifically looks for Event ID 5136 (Directory Service Changes) indicating modifications to GPO attributes related to machine or user extension names, and Event ID 5145 (Detailed File Share) indicating write access to ScheduledTasks.xml within the SYSVOL share.
Detects modifications to Group Policy Object (GPO) attributes, specifically 'gPCMachineExtensionNames', that are indicative of adding privileges to user accounts or adding users as local administrators. This is identified by the presence of specific GUIDs ('827D319E-6EAC-11D2-A4EA-00C04F79F83A' or '803E14A0-B4FB-11D0-A0D0-00A0C90F574B') within the 'AttributeValue' field of EventID 5136. These GUIDs are associated with Group Policy extensions that can be abused for privilege escalation.
Detects when the 'SeEnableDelegationPrivilege' user right is assigned in Active Directory. This privilege allows a user to control other Active Directory user objects, which can be abused for privilege escalation and persistence within a domain.
Detects PowerShell being used to modify Group Policy Objects (GPOs) to disable Windows Defender security features. This technique is used by threat actors like Storm-2603 for defense evasion.
Detects scenarios where an attacker will attempt to take control over a group policy.
Detects scenarios where an attacker will attempt to take control over a group policy.
Detects when a Group Policy Object (GPO) is modified to include Client-Side Extensions (CSEs) for managing local group memberships or user rights assignments. While this can be a legitimate administrative action, attackers can abuse this capability to escalate privileges by adding accounts to sensitive local groups (e.g., Administrators) or granting powerful user rights. This alert serves as an early warning to investigate the specific changes made within the GPO.
Detects modifications to Group Policy Objects (GPOs) that enable script processing. Threat actors, such as Storm-2603, abuse GPOs to deploy ransomware (like Warlock) by adding malicious startup or logon scripts. This detection identifies when the "Group Policy Scripts" client-side extension is added to a GPO, which is a key step in this attack chain. This activity is logged under Event ID 5136 on Domain Controllers.
Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins.
KQL Query from file: Entra Cross-Tenant Activity Monitoring
Detects potential suspicious behavior using secedit.exe, specifically when it is used to export or modify the security policy. This could indicate an adversary attempting to understand or alter system security configurations for persistence, privilege escalation, or defense evasion.
Page 5 of 6