Windows PowerShell: GPO ScriptBlock Modifying Group Policy and SmartScreen Settings

Alerts on PowerShell ScriptBlock content referencing Group Policy policy keys and specific security policy value names.

FreeReviewedSigma · Medium · v2

Product: windows
Category: ps_script
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2022-08-19
Updated: 2026-07-31

ATT&CK techniques

Priv Esc → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1484.001Group Policy Modification
Defense Evasion
- T1484.001Group Policy Modification
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies PowerShell activity containing registry policy paths and specific group policy-related values, including Group Policy refresh timing and SmartScreen configuration. Attackers can use GPO modifications to impair defenses or enforce malicious settings across systems, making this a high-signal defense-impairment indicator. The detection relies on Script Block Logging telemetry by matching specific substrings within captured ScriptBlockText.

Reporting behind it

Related detections9 linkedT1484.001 — drag to rearrange

Suspicious Modification of a Sensitive Group Policy - GPO (via security)

Suspicious Group Policy File System Path Redirection via Directory Service Change

Malicious GPO Permission Abuse via SharpGPOAbuse

Suspicious Executable Launched from SYSVOL Share

Malicious SharpGPOAbuse GPO Modification Tool from Public Directory

Suspicious Permissions Changed on a Group Policy - GPO (via security)

Suspicious Executable Launched from Domain Netlogon Share (via process_creation)

Windows Process: GPME Used to Modify Default Domain and Default Domain Controllers GPOs

Windows Security Event 5136 for Changes to Default Domain and Default Domain Controllers GPOs

Windows PowerShell: GPO ScriptBlock Modifying Group Policy and SmartScreen Settings

Pivot detection · T1484.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-detect-scriptblock-text-modifying-group-policy-settings-b7216a7d

title: "Windows PowerShell: GPO ScriptBlock Modifying Group Policy and SmartScreen Settings"
id: 32d8df7d-5d62-4923-88c9-c20654d7b462
related:
  - id: ada4b0c4-758b-46ac-9033-9004613a150d
    type: similar
  - id: b7216a7d-687e-4c8d-82b1-3080b2ad961f
    type: derived
status: test
description: This rule identifies PowerShell activity containing registry policy paths and specific group policy-related values, including Group Policy refresh timing and SmartScreen configuration. Attackers can use GPO modifications to impair defenses or enforce malicious settings across systems, making this a high-signal defense-impairment indicator. The detection relies on Script Block Logging telemetry by matching specific substrings within captured ScriptBlockText.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1484.001/T1484.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_modify_group_policy_settings.yml
author: frack113, Huntrule Team
date: 2022-08-19
tags:
  - attack.privilege-escalation
  - attack.defense-impairment
  - attack.t1484.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_path:
    ScriptBlockText|contains: \SOFTWARE\Policies\Microsoft\Windows\System
  selection_key:
    ScriptBlockText|contains:
      - GroupPolicyRefreshTimeDC
      - GroupPolicyRefreshTimeOffsetDC
      - GroupPolicyRefreshTime
      - GroupPolicyRefreshTimeOffset
      - EnableSmartScreen
      - ShellSmartScreenLevel
  condition: all of selection_*
falsepositives:
  - Legitimate use
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL