Try in Splunk Security Cloud

Description

This detection identifies when an Active Directory Group Policy is disabled using the Group Policy Management Console.

  • Type: TTP

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud

  • Last Updated: 2023-11-24
  • Author: Dean Luxton
  • ID: 72793bc0-c0cd-400e-9e60-fdf36f278917

Annotations

ATT&CK

ATT&CK

ID Technique Tactic
T1562.001 Disable or Modify Tools Defense Evasion
T1484.001 Group Policy Modification Defense Evasion, Privilege Escalation
Kill Chain Phase
  • Exploitation
NIST
  • DE.CM
CIS20
  • CIS 10
CVE 


1
2
3
4
5
6
7
8



`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=flags OperationType="%%14674" AttributeValue!=0 
| eval AttributeValueExp=case(AttributeValue==0,"Enabled",AttributeValue==1,"User configuration settings disabled",AttributeValue==2,"Computer configuration settings disabled",AttributeValue==3,"Disabled"), ObjectDN=upper(ObjectDN) 
| join ObjectDN type=inner [
| search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update 
| eval ObjectDN=upper(distinguishedName) 
| stats latest(displayName) as displayName by ObjectDN ] 
| stats min(_time) as _time values(AttributeValue) as AttributeValue values(AttributeValueExp) as AttributeValueExp values(OpCorrelationID) as OpCorrelationID values(displayName) as policyName values(src_user) as src_user by ObjectDN SubjectLogonId 
| `windows_ad_gpo_disabled_filter`

Macros

The SPL above uses the following Macros:

:information_source: windows_ad_gpo_disabled_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

  • _time
  • OperationType
  • ObjectDN
  • OpCorrelationID
  • src_user
  • AttributeLDAPDisplayName
  • AttributeValue
  • ObjectClass
  • SubjectLogonId
  • DSName

How To Implement

Ensure you are ingesting Active Directory audit logs - specifically event 5136, admon data is also used to display the display name of the GPO. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security and admon macros are configured with the correct indexes.

Known False Positives

Unknown

Associated Analytic Story

RBA

Risk Score Impact Confidence Message
64.0 80 80 $src_user$ has disabled GPO $policyName$

:information_source: The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1