T1484.001Privilege EscalationDefense Impairment
Group Policy Modification
Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain. Group policy allows for centralized management of user and computer settings in Active Directory (AD). GPOs are containers for group policy settings made up of files stored within a predictable network path…
CVEs1
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.1
Reports0
Detections
6 Sigma rules tagged T1484.001Group Policy ModificationT1484.0016 general rules
- Group Policy Abuse for Privilege Additionmediumtest
- Modify Group Policy Settingsmediumtest
- Modify Group Policy Settings - ScriptBlockLoggingmediumtest
- Startup/Logon Script Added to Group Policy Objectmediumtest
- Windows Default Domain GPO Modificationmediumexperimental
- Windows Default Domain GPO Modification via GPMEmediumexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Group Policy Modification
1 CVE, by priority. Each link shows its badge.- CVE-2023-26360Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityAdobe · ColdFusionKEVPublic exploitHigh · 8.6T1190Exploit Public-Facing ApplicationT1059.007JavaScript+7 moreMITRE CTID mapping of the KEV entry · follow-on activity97.3%Top 0.1%69.0priority