Suspicious Windows Default Domain GPO Change through GPME (via process_creation)

title: Suspicious Windows Default Domain GPO Change through GPME (via process_creation)
id: eddd6a6a-8a6f-5904-ae71-c366ae458300
status: stable
description: This rule detects the use of the Group Policy Management Editor (GPME) to modify Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may abuse GPME to make stealthy changes in these default GPOs to deploy hostile GPOs configurations across the domain without raising suspicion.
references:
    - https://attack.mitre.org/techniques/T1484/001/
    - https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html
    - https://adsecurity.org/?p=3377
    - https://sdmsoftware.com/general-stuff/launching-the-new-gp-management-editor-from-the-command-line/
    - https://www.pentestpartners.com/security-blog/living-off-the-land-gpo-style/
author: Huntrule Team
date: 2026-06-28
tags:
    - attack.privilege-escalation
    - attack.defense-impairment
    - attack.t1484.001
logsource:
    product: windows
    category: process_creation
detection:
    selection_mmc:
        - Image|endswith: '\mmc.exe'
        - OriginalFileName: 'MMC.exe'
    selection_gpme:
        CommandLine|contains|all:
            - 'gpme.msc'
            - 'gpobject:'
    selection_default_gpos:
        CommandLine|contains:
            - '31B2F340-016D-11D2-945F-00C04FB984F9'
            - '6AC1786C-016F-11D2-945F-00C04FB984F9'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium