Windows Process: GPME Used to Modify Default Domain and Default Domain Controllers GPOs

Flags MMC launching GPME to target Default Domain/Default Domain Controllers GPO objects by GUID via gpobject.

FreeUnreviewedSigmamediumv1

windows-process-gpme-used-to-modify-default-domain-and-default-domain-controller-dcff7e85

title: "Windows Process: GPME Used to Modify Default Domain and Default Domain Controllers GPOs"
id: aeb3e864-b96b-4b45-b4a4-c0c3cd8de95d
related:
  - id: e5ac86dd-2da1-454b-be74-05d26c769d7d
    type: similar
  - id: dcff7e85-d01f-4eb5-badd-84e2e6be8294
    type: derived
status: experimental
description: This rule identifies process executions of MMC (mmc.exe) where the command line includes gpme.msc and a gpobject target that references Default Domain or Default Domain Controllers GPO GUIDs. Modifying these default GPOs matters because it can enable widespread and persistent configuration changes across Active Directory environments. The detection relies on Windows process creation telemetry, matching the command line contents for GPME usage and the specific default GPO identifiers.
references:
  - https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html
  - https://adsecurity.org/?p=3377
  - https://sdmsoftware.com/general-stuff/launching-the-new-gp-management-editor-from-the-command-line/
  - https://www.pentestpartners.com/security-blog/living-off-the-land-gpo-style/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mmc_default_domain_gpo_modification_via_gpme.yml
author: TropChaud, Huntrule Team
date: 2025-11-22
tags:
  - attack.privilege-escalation
  - attack.defense-impairment
  - attack.t1484.001
logsource:
  product: windows
  category: process_creation
detection:
  selection_mmc:
    - Image|endswith: \mmc.exe
    - OriginalFileName: MMC.exe
  selection_gpme:
    CommandLine|contains|all:
      - gpme.msc
      - "gpobject:"
  selection_default_gpos:
    CommandLine|contains:
      - 31B2F340-016D-11D2-945F-00C04FB984F9
      - 6AC1786C-016F-11D2-945F-00C04FB984F9
  condition: all of selection_*
falsepositives:
  - Legitimate use of GPME to modify GPOs
level: medium
license: DRL-1.1

What it detects

This rule identifies process executions of MMC (mmc.exe) where the command line includes gpme.msc and a gpobject target that references Default Domain or Default Domain Controllers GPO GUIDs. Modifying these default GPOs matters because it can enable widespread and persistent configuration changes across Active Directory environments. The detection relies on Windows process creation telemetry, matching the command line contents for GPME usage and the specific default GPO identifiers.

Known false positives

Legitimate use of GPME to modify GPOs

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.