Windows AD GPO Deleted

Try in Splunk Security Cloud

Description

This detection identifies when an Active Directory Group Policy is deleted using the Group Policy Management Console.

• Type: TTP

• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud

• Last Updated: 2023-11-24
• Author: Dean Luxton
• ID: 0d41772b-35ab-4e1c-a2ba-d0b455481aee

Annotations

ATT&CK

ATT&CK

ID	Technique	Tactic
T1562.001	Disable or Modify Tools	Defense Evasion

T1484.001

Group Policy Modification

Defense Evasion, Privilege Escalation

Kill Chain Phase

• Exploitation

NIST

• DE.CM

CIS20

• CIS 10

CVE

Search

`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=gpLink 
| eval  ObjectDN=upper(ObjectDN) 
| stats min(_time) as eventTime values(eval(if(OperationType=="%%14675",AttributeValue,null))) as old_value values(eval(if(OperationType=="%%14674",AttributeValue,null))) as new_value values(OperationType) as OperationType values(src_user) as src_user by OpCorrelationID ObjectDN SubjectLogonId 
| rex field=old_value max_match=10000 "(?i)LDAP://(?P<old_dn>cn.*?);(?P<old_flag>\d)\]" 
| rex field=new_value max_match=10000 "(?i)LDAP://(?P<new_dn>cn.*?);(?P<new_flag>\d)\]" 
| mvexpand old_dn 
| where NOT old_dn IN (new_dn) 
| eval ObjectDN=upper(old_dn) 
| join ObjectDN type=outer [
| search `admon` objectCategory="CN=Group-Policy-Container*" admonEventType=Update 
| eval ObjectDN=upper(distinguishedName) 
| stats latest(displayName) as displayName by ObjectDN ] 
| stats min(eventTime) as _time values(OpCorrelationID) as OpCorrelationID values(displayName) as policyName values(src_user) as src_user by ObjectDN SubjectLogonId 
| `windows_ad_gpo_deleted_filter`

Macros

The SPL above uses the following Macros:

• admon
• wineventlog_security

windows_ad_gpo_deleted_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

• _time
• OperationType
• ObjectDN
• OpCorrelationID
• src_user
• AttributeLDAPDisplayName
• AttributeValue
• ObjectClass
• SubjectLogonId
• DSName

How To Implement

Ensure you are ingesting Active Directory audit logs - specifically event 5136, admon data is also used to display the display name of the GPO. See lantern article in references for further on how to onboard AD audit data. Ensure the wineventlog_security and admon macros are configured with the correct indexes.

Known False Positives

Unknown

Associated Analytic Story

• Sneaky Active Directory Persistence Tricks

RBA

Risk Score	Impact	Confidence	Message
64.0	80	80	GPO $policyName$ was deleted by $src_user$

The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

• https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1