Detection rules › Splunk

Windows Default Group Policy Object Modified

Author

Mauricio Velazco, Splunk

Source

upstream

The following analytic detects modifications to default Group Policy Objects (GPOs) using Event ID 5136. It monitors changes to the Default Domain Controllers Policy and Default Domain Policy, which are critical for enforcing security settings across domain controllers and all users/computers, respectively. This activity is significant because unauthorized changes to these GPOs can indicate an adversary with privileged access attempting to deploy persistence mechanisms or execute malware across the network. If confirmed malicious, such modifications could lead to widespread compromise, allowing attackers to maintain control and execute arbitrary code on numerous hosts.