Group Policy Abuse for Privilege Additionedit

This rule detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins.

Rule type: query

Rule indices:

  • winlogbeat-*
  • logs-system.*

Severity: high

Risk score: 73

Runs every: 5 minutes

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100



  • Elastic
  • Host
  • Windows
  • Threat Detection
  • Privilege Escalation
  • Active Directory

Version: 1

Added (Elastic Stack release): 8.0.0

Rule authors: Elastic

Rule license: Elastic License v2

Investigation guideedit

## Triage and analysis

### Investigating Group Policy Abuse for Privilege Addition

Group Policy Objects can be used to add rights and/or modify Group Membership on GPOs by changing the contents of an INF file named
GptTmpl.inf, which is responsible for storing every setting under the Security Settings container in the GPO, this file is unique
for each GPO, and only exists if the GPO contains security settings.
Example Path: "\\\SysVol\\Policies\{21B9B880-B2FB-4836-9C2D-2013E0D832E9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf"

#### Possible investigation steps:
- This attack abuses a legitimate mechanism of the Active Directory, so it is important to determine whether the activity is legitimate
and the administrator is authorized to perform this operation.
- Retrieve the contents of the `GptTmpl.inf` file, under the `Privilege Rights` section, look for potentially dangerous high privileges,
for example: SeTakeOwnershipPrivilege, SeEnableDelegationPrivilege, etc.
- Inspect the user SIDs associated with these privileges

### False Positive Analysis
- Verify if these User SIDs should have these privileges enabled.
- Inspect whether the user that has done these modifications should be allowed to do it. The user name can be found in the
`winlog.event_data.SubjectUserName` field

### Related Rules
- Scheduled Task Execution at Scale via GPO
- Startup/Logon Script added to Group Policy Object

### Response and Remediation
- Immediate response should be taken to validate activity, investigate and potentially isolate activity to prevent further
post-compromise behavior.

## Config

The 'Audit Directory Service Changes' audit policy is required be configured (Success Failure).
Steps to implement the logging policy with with Advanced Audit Configuration:
Computer Configuration >
Policies >
Windows Settings >
Security Settings >
Advanced Audit Policies Configuration >
Audit Policies >
DS Access >
Audit Directory Service Changes (Success,Failure)

Rule queryedit

event.code: "5136" and
and winlog.event_data.AttributeValue:(*827D319E-6EAC-11D2-A4EA-00C04F
79F83A* and *803E14A0-B4FB-11D0-A0D0-00A0C90F574B*)

Threat mappingedit