Techniques › T1484.001 › AN0854
AN0854 Analytic 0854
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Adversary modifies GPO containers or files under SYSVOL using LDAP, ADSI, PowerShell (e.g., New-GPOImmediateTask) or GUI tools. This includes directory object changes (e.g., gPCFileSysPath), delegation assignments (SeEnableDelegationPrivilege), and SYSVOL file writes (ScheduledTasks.xml, GptTmpl.inf).</p>
- Detects
- T1484.001 Group Policy Modification
- Part of
- DET0305 Detection of Group Policy Modifications via AD Object Changes and File Activity
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=5136 | DC0066 Active Directory Object Modification |
| WinEventLog:Security | EventCode=4663, 4670, 4656 | DC0061 File Modification |
| WinEventLog:Security | EventCode=4704 | DC0010 User Account Modification |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ObjectDN | Focus detection on AD paths like CN=Policies,CN=System,DC=domain,DC=com. |
TargetFilename | Target specific files like ScheduledTasks.xml or GptTmpl.inf in SYSVOL. |
TimeWindow | Correlate GPO object change and SYSVOL file modification within N seconds. |
UserContext | Alert on unexpected modification by non-admins or uncommon accounts. |
CommandLine | Flag usage of GPO manipulation tools like Set-GPRegistryValue, New-GPOImmediateTask. |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2023-26360 | Adobe ColdFusion | Mapped |