Windows Group Policy Object Attribute Change Adding Privileges or Local Admins

title: Windows Group Policy Object Attribute Change Adding Privileges or Local Admins
id: f21a6d0c-f518-4357-b811-c1848ef90455
status: test
description: This rule flags the first observed modification to Group Policy Object (GPO) machine extension attributes that can grant privileges to user accounts or enable adding users as local administrators. Attackers may abuse GPO changes to persistently elevate privileges or weaken system defenses across endpoints. It relies on Windows Security auditing events (EventID 5136) that include the LDAP display name and attribute values associated with the relevant GPO extension identifiers, along with the subject information for contextual triage.
author: Elastic, Josh Nickels, Marius Rothenbücher, Huntrule Team
references:
  - https://www.elastic.co/guide/en/security/current/group-policy-abuse-for-privilege-addition.html#_setup_275
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_group_policy_abuse_privilege_addition.yml
date: 2024-09-04
tags:
  - attack.privilege-escalation
  - attack.defense-impairment
  - attack.t1484.001
logsource:
  product: windows
  service: security
  definition: 'Requirements: The "Audit Directory Service Changes" logging policy must be configured in order to receive events.'
detection:
  selection:
    EventID: 5136
    AttributeLDAPDisplayName: gPCMachineExtensionNames
    AttributeValue|contains:
      - 827D319E-6EAC-11D2-A4EA-00C04F79F83A
      - 803E14A0-B4FB-11D0-A0D0-00A0C90F574B
  condition: selection
falsepositives:
  - Users allowed to perform these modifications (user found in field SubjectUserName)
level: medium
license: DRL-1.1
related:
  - id: 1c480e10-7ee1-46d4-8ed2-85f9789e3ce4
    type: derived