Windows Security: Group Policy Object modification adds privileges to user accounts

Alerts on Windows GPO attribute changes that correspond to adding privileges or making users local admins.

FreeReviewedSigma · Medium · v2

Product: windows
Service: security
Author: Elastic, Josh Nickels, Marius Rothenbücher (SigmaHQ), DRL 1.1
Published: 2024-09-04
Updated: 2026-07-31

ATT&CK techniques

Priv Esc → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1484.001Group Policy Modification
Defense Evasion
- T1484.001Group Policy Modification
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags the first observed Windows Security event (EventID 5136) where a Group Policy Object attribute related to machine extension names is modified. The matched attribute values indicate changes consistent with adding privileges to user accounts or using Group Policy to add users as local administrators. It relies on directory service change auditing telemetry that records LDAP object attribute modifications, including the actor identity (SubjectUserName) and the modified attribute/value details.

Reporting behind it

Related detections9 linkedT1484.001 — drag to rearrange

Suspicious Modification of a Sensitive Group Policy - GPO (via security)

Suspicious Group Policy File System Path Redirection via Directory Service Change

Malicious GPO Permission Abuse via SharpGPOAbuse

Suspicious Executable Launched from SYSVOL Share

Malicious SharpGPOAbuse GPO Modification Tool from Public Directory

Suspicious Permissions Changed on a Group Policy - GPO (via security)

Suspicious Executable Launched from Domain Netlogon Share (via process_creation)

Windows Process: GPME Used to Modify Default Domain and Default Domain Controllers GPOs

Windows Security Event 5136 for Changes to Default Domain and Default Domain Controllers GPOs

Windows Security: Group Policy Object modification adds privileges to user accounts

Pivot detection · T1484.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-group-policy-object-attribute-change-adding-privileges-or-local-admins-1c480e10

title: "Windows Security: Group Policy Object modification adds privileges to user accounts"
id: f21a6d0c-f518-4357-b811-c1848ef90455
status: test
description: This rule flags the first observed Windows Security event (EventID 5136) where a Group Policy Object attribute related to machine extension names is modified. The matched attribute values indicate changes consistent with adding privileges to user accounts or using Group Policy to add users as local administrators. It relies on directory service change auditing telemetry that records LDAP object attribute modifications, including the actor identity (SubjectUserName) and the modified attribute/value details.
author: Elastic, Josh Nickels, Marius Rothenbücher, Huntrule Team
references:
  - https://www.elastic.co/guide/en/security/current/group-policy-abuse-for-privilege-addition.html#_setup_275
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_group_policy_abuse_privilege_addition.yml
date: 2024-09-04
tags:
  - attack.privilege-escalation
  - attack.defense-impairment
  - attack.t1484.001
logsource:
  product: windows
  service: security
  definition: 'Requirements: The "Audit Directory Service Changes" logging policy must be configured in order to receive events.'
detection:
  selection:
    EventID: 5136
    AttributeLDAPDisplayName: gPCMachineExtensionNames
    AttributeValue|contains:
      - 827D319E-6EAC-11D2-A4EA-00C04F79F83A
      - 803E14A0-B4FB-11D0-A0D0-00A0C90F574B
  condition: selection
falsepositives:
  - Users allowed to perform these modifications (user found in field SubjectUserName)
level: medium
license: DRL-1.1
related:
  - id: 1c480e10-7ee1-46d4-8ed2-85f9789e3ce4
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL