Windows Process: GPME Used to Modify Default Domain and Default Domain Controllers GPOs
Flags MMC launching GPME to target Default Domain/Default Domain Controllers GPO objects by GUID via gpobject.
- Product
- windows
- Category
- process_creation
- Author
- TropChaud (SigmaHQ), DRL 1.1
- Published
- 2025-11-22
- Updated
- 2026-07-30
ATT&CK techniques
Priv Esc → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions of MMC (mmc.exe) where the command line includes gpme.msc and a gpobject target that references Default Domain or Default Domain Controllers GPO GUIDs. Modifying these default GPOs matters because it can enable widespread and persistent configuration changes across Active Directory environments. The detection relies on Windows process creation telemetry, matching the command line contents for GPME usage and the specific default GPO identifiers.
Reporting behind it
- trendmicro.comhttps://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html
- adsecurity.orghttps://adsecurity.org/?p=3377
- sdmsoftware.comhttps://sdmsoftware.com/general-stuff/launching-the-new-gp-management-editor-from-the-command-line/
- pentestpartners.comhttps://www.pentestpartners.com/security-blog/living-off-the-land-gpo-style/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mmc_default_domain_gpo_modification_via_gpme.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process: GPME Used to Modify Default Domain and Default Domain Controllers GPOs"
id: aeb3e864-b96b-4b45-b4a4-c0c3cd8de95d
related:
- id: e5ac86dd-2da1-454b-be74-05d26c769d7d
type: similar
- id: dcff7e85-d01f-4eb5-badd-84e2e6be8294
type: derived
status: experimental
description: This rule identifies process executions of MMC (mmc.exe) where the command line includes gpme.msc and a gpobject target that references Default Domain or Default Domain Controllers GPO GUIDs. Modifying these default GPOs matters because it can enable widespread and persistent configuration changes across Active Directory environments. The detection relies on Windows process creation telemetry, matching the command line contents for GPME usage and the specific default GPO identifiers.
references:
- https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html
- https://adsecurity.org/?p=3377
- https://sdmsoftware.com/general-stuff/launching-the-new-gp-management-editor-from-the-command-line/
- https://www.pentestpartners.com/security-blog/living-off-the-land-gpo-style/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mmc_default_domain_gpo_modification_via_gpme.yml
author: TropChaud, Huntrule Team
date: 2025-11-22
tags:
- attack.privilege-escalation
- attack.defense-impairment
- attack.t1484.001
logsource:
product: windows
category: process_creation
detection:
selection_mmc:
- Image|endswith: \mmc.exe
- OriginalFileName: MMC.exe
selection_gpme:
CommandLine|contains|all:
- gpme.msc
- "gpobject:"
selection_default_gpos:
CommandLine|contains:
- 31B2F340-016D-11D2-945F-00C04FB984F9
- 6AC1786C-016F-11D2-945F-00C04FB984F9
condition: all of selection_*
falsepositives:
- Legitimate use of GPME to modify GPOs
level: medium
license: DRL-1.1