Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
126 detections
Filters
Last updated
All Time
Detection languages
56
31
17
8
4
Contributors
34
24
15
15
9
Categories
83
49
27
27
17
Platforms
109
17
13
1
1
Products / Services
79
66
18
16
9
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
2
1
IDS Protocols
3
The following analytic detects the creation of a new Group Policy Object (GPO) using Splunk's Admon data. It identifies events where a new GPO is created, excluding default "New Group Policy Object" entries. Monitoring GPO creation is crucial as adversaries can exploit GPOs to escalate privileges or deploy malware across an Active Directory network. If confirmed malicious, this activity could allow attackers to control system configurations, deploy ransomware, or propagate malware, significantly compromising the network's security.
This analytic detects modifications to the default Group Policy Objects (GPOs) in an Active Directory environment. It leverages Splunk's Admon to monitor updates to the "Default Domain Policy" and "Default Domain Controllers Policy." This activity is significant because changes to these default GPOs can indicate an adversary with privileged access attempting to gain further control, establish persistence, or deploy malware across multiple hosts. If confirmed malicious, such modifications could lead to widespread policy enforcement changes, unauthorized access, and potential compromise of the entire domain environment.
Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.
Detect malicious GPO modifications can be used to implement many other malicious behaviors.
"This query searches for any action type with high frequency that involves adding, modifying, or removing something in cloud app policies. It sees where the properties are modified such that the old value and new value are different for every property except for minor property changes such as Display Name."
Author: alex verboon @alexverboon.
Blogpost: https://www.verboon.info/2020/09/hunting-for-local-group-membership-changes.
Blogpost: https://www.verboon.info/2020/09/hunting-for-local-group-membership-changes.
'This query detects lateral movement using GPO scheduled task usually used to deploy ransomware at scale.
It monitors whether a scheduled task is modified within the Sysvol folder in GPO.
Ref: https://bogusecurity.com/2019/12/26/persistence-and-execution-at-scale-via-gpo-scheduled-task/'
It monitors whether a scheduled task is modified within the Sysvol folder in GPO.
Ref: https://bogusecurity.com/2019/12/26/persistence-and-execution-at-scale-via-gpo-scheduled-task/'
Detect malicious GPO modifications can be used to implement many other malicious behaviors.
Detect malicious GPO modifications can be used to implement many other malicious behaviors.
'This query looks for the Sdelete process being run recursively after being deployed to a host via GPO. Attackers could use this technique to deploy Sdelete to multiple host and delete data on them.
This query uses the Advanced Security Information Model. Parsers will need to be deployed before use: https://docs.microsoft.com/azure/sentinel/normalization'
This query uses the Advanced Security Information Model. Parsers will need to be deployed before use: https://docs.microsoft.com/azure/sentinel/normalization'
'This detection highlights executables deployed to hosts via either the Default Domain or Default Domain Controller Policies. These policies apply to all hosts or Domain Controllers and best practice is that these policies should not be used for deployment of files.
A threat actor may use these policies to deploy files or scripts to all hosts in a domain.
This query uses the ASIM parsers and will need them deployed before usage - https://docs.microsoft.com/azure/sentinel/normalization'
A threat actor may use these policies to deploy files or scripts to all hosts in a domain.
This query uses the ASIM parsers and will need them deployed before usage - https://docs.microsoft.com/azure/sentinel/normalization'
This detection identifies when a new client-side extension is added to an Active Directory Group Policy using the Group Policy Management Console. This can be an indicator of an adversary attempting to establish persistence or escalate privileges by modifying GPOs to execute malicious code or configurations on domain-joined machines.
The analytic detects the creation of a new Group Policy Object (GPO) by leveraging Windows Event IDs 5136 and 5137. These directory service change events indicate when a new GPO is created. Monitoring GPO creation is critical because adversaries can exploit GPOs to escalate privileges or deploy malware across an Active Directory network. Malicious GPO creation could allow attackers to control system configurations, deploy ransomware, or propagate malware, leading to widespread compromise and significant operational disruption.
The analytic detects modifications to default Group Policy Objects (GPOs) using Event ID 5136. It monitors changes to the `Default Domain Controllers Policy` and `Default Domain Policy`, which are critical for enforcing security settings across domain controllers and all users/computers, respectively. This activity is significant because unauthorized changes to these GPOs can indicate an adversary with privileged access attempting to deploy persistence mechanisms or execute malware across the network. If confirmed malicious, such modifications could lead to widespread compromise, allowing attackers to maintain control and execute arbitrary code on numerous hosts.
This detection identifies when an Active Directory Group Policy is deleted using the Group Policy Management Console. Deleting Group Policy Objects (GPOs) can be a legitimate administrative action, but it can also be used by adversaries to remove security controls, disable logging, or clean up traces of their activity. Monitoring for GPO deletions is crucial for maintaining the integrity of an Active Directory environment.
This detection identifies when an Active Directory Group Policy Object (GPO) is disabled. Adversaries may disable GPOs to impair defenses, remove security policies, or facilitate other malicious activities within the domain. The rule specifically looks for EventCode 5136 with AttributeLDAPDisplayName 'flags' and an AttributeValue indicating the GPO is disabled (values 1, 2, or 3). It then joins this with Active Directory monitoring data to get the display name of the GPO.
The following analytic detects modifications to default Group Policy Objects (GPOs) using the Group Policy Management Editor (GPME). It leverages the Endpoint data model to identify processes where `mmc.exe` executes `gpme.msc` with specific GUIDs related to default GPOs. This activity is significant because default GPOs, such as the `Default Domain Controllers Policy` and `Default Domain Policy`, are critical for enforcing security policies across the domain. If malicious, such modifications could allow an attacker to gain further access, establish persistence, or deploy malware across numerous hosts, severely compromising the network's security.
Detects when an AWS account makes changes to the ingress or egress rules of a security group. This activity can indicate an attacker attempting to open new attack vectors, exfiltrate data over the network, or allow compromised machines to contact a command and control (C2) server.
Detects modifications to Group Policy settings using `reg.exe` by looking for specific registry paths and keys commonly associated with Group Policy configurations. Malicious GPO modifications can be used to implement various other malicious behaviors, including privilege escalation and defense evasion.
This rule detects the creation of executable files (.exe) or dynamic link libraries (.dll) within the default Group Policy Object (GPO) storage folder. Adversaries may place malicious files in this location to leverage Group Policy for persistence, privilege escalation, or to distribute malware across a domain. The specific folder path targeted is '\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\' which corresponds to the Default Domain Policy GPO.
Detects attempts to modify Group Policy settings related to system behavior or security features by analyzing PowerShell script block logs. This rule specifically looks for modifications to registry paths associated with Group Policy settings, such as refresh times or SmartScreen configurations, which could indicate an adversary attempting to establish persistence, evade defenses, or escalate privileges.
Page 6 of 6