Windows Admon Default Group Policy Object Modified

Description

The following analytic detects modifications to the default Group Policy Objects (GPOs) in an Active Directory environment. It leverages Splunk's Admon to monitor updates to the "Default Domain Policy" and "Default Domain Controllers Policy." This activity is significant because changes to these default GPOs can indicate an adversary with privileged access attempting to gain further control, establish persistence, or deploy malware across multiple hosts. If confirmed malicious, such modifications could lead to widespread policy enforcement changes, unauthorized access, and potential compromise of the entire domain environment.

Query · spl

`admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*" (displayName="Default Domain Policy" OR displayName="Default Domain Controllers Policy")
  | stats min(_time) as firstTime max(_time) as lastTime values(gPCFileSysPath)
    BY dcName, displayName
  | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`
  | `windows_admon_default_group_policy_object_modified_filter`

Implementation guide

To successfully implement this search, you need to be monitoring Active Directory logs using Admon. Details can be found here https://help.splunk.com/en/splunk-cloud-platform/get-started/get-data-in/9.3.2411/get-windows-data/monitor-active-directory

Known false positives

  • The default Group Policy Objects within an AD network may be legitimately updated for administrative operations, filter as needed.

Analyst notes

Known false positives: The default Group Policy Objects within an AD network may be legitimately updated for administrative operations, filter as needed.

Raw source Windows Admon Default Group Policy Object Modified · SPL
Esc
Published by splunk/security_content ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
name: Windows Admon Default Group Policy Object Modified
id: 83458004-db60-4170-857d-8572f16f070b
version: 12
creation_date: '2023-03-28'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects modifications to the default Group Policy Objects (GPOs) in an Active Directory environment. It leverages Splunk's Admon to monitor updates to the "Default Domain Policy" and "Default Domain Controllers Policy." This activity is significant because changes to these default GPOs can indicate an adversary with privileged access attempting to gain further control, establish persistence, or deploy malware across multiple hosts. If confirmed malicious, such modifications could lead to widespread policy enforcement changes, unauthorized access, and potential compromise of the entire domain environment.
data_source:
    - Windows Active Directory Admon
search: |-
    `admon` admonEventType=Update objectCategory="CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=*" (displayName="Default Domain Policy" OR displayName="Default Domain Controllers Policy")
      | stats min(_time) as firstTime max(_time) as lastTime values(gPCFileSysPath)
        BY dcName, displayName
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_admon_default_group_policy_object_modified_filter`
how_to_implement: To successfully implement this search, you need to be monitoring Active Directory logs using Admon. Details can be found here https://help.splunk.com/en/splunk-cloud-platform/get-started/get-data-in/9.3.2411/get-windows-data/monitor-active-directory
known_false_positives: The default Group Policy Objects within an AD network may be legitimately updated for administrative operations, filter as needed.
references:
    - https://attack.mitre.org/techniques/T1484/
    - https://attack.mitre.org/techniques/T1484/001
    - https://www.trustedsec.com/blog/weaponizing-group-policy-objects-access/
    - https://adsecurity.org/?p=2716
    - https://help.splunk.com/en/splunk-cloud-platform/get-started/get-data-in/9.3.2411/get-windows-data/monitor-active-directory
drilldown_searches:
    - name: View the detection results for - "$dcName$"
      search: '%original_detection_search% | search  dcName = "$dcName$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$dcName$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dcName$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
finding:
    title: A default domain group policy was updated on $dcName$
    entity:
        field: dcName
        type: system
        score: 50
analytic_story:
    - Active Directory Privilege Escalation
    - Sneaky Active Directory Persistence Tricks
asset_type: Endpoint
mitre_attack_id:
    - T1484.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.001/default_domain_policy_modified/windows-security.log
          source: ActiveDirectory
          sourcetype: ActiveDirectory
      test_type: unit

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.