Suspicious Windows Default Domain GPO Change (via security)

title: Suspicious Windows Default Domain GPO Change (via security)
id: 67173004-9699-515f-a5a9-1b394f38fbbd
status: stable
description: This rule detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may modify these default GPOs to deploy hostile configurations across the domain.
references:
    - https://attack.mitre.org/techniques/T1484/001/
    - https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html
    - https://adsecurity.org/?p=3377
    - https://www.pentestpartners.com/security-blog/living-off-the-land-gpo-style/
    - https://jgspiers.com/audit-group-policy-changes/
author: Huntrule Team
date: 2026-06-24
tags:
    - attack.privilege-escalation
    - attack.defense-impairment
    - attack.t1484.001
logsource:
    product: windows
    service: security
    definition: |
        Enable 'Audit Directory Service Changes' in the Default Domain Controllers Policy under:
        Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> Audit Policies -> DS Access -> Audit Directory Service Changes (Success).
        Additionally, proper SACL needs to be configured on the 'CN=Policies,CN=System,DC=<domain>,DC=<tld>' container in Active Directory to capture changes to Group Policy Objects.
detection:
    selection:
        EventID: 5136
        ObjectClass: 'groupPolicyContainer'
        ObjectDN|startswith:
            - 'CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM'
            - 'CN={6AC1786C-016F-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM'
    condition: selection
falsepositives:
    - Unknown
level: medium