T1484.001 — Group Policy Modification

Tactics: Defense Impairment, Privilege Escalation · Platforms: Windows

Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain. Group policy allows for centralized management of user and computer settings in Active Directory (AD). GPOs are…

Sub-technique of Domain or Tenant Policy Modification (T1484).

Sigma detection rules (1)

T1484.001 Domain or Tenant Policy Modification: Group Policy Modification

title: "T1484.001 Domain or Tenant Policy Modification: Group Policy Modification"
id: d8a57bb6-55cf-4471-8721-91473d549643
description: 'Detection of Group Policy Object modifications via file writes to SYSVOL Policies paths (GPT.INI, Registry.pol, GptTmpl.inf, ScheduledTasks.xml). (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: ObjectDN, TargetFilename, TimeWindow, UserContext, CommandLine.'
references:
  - https://attack.mitre.org/techniques/T1484/001
author: Shahrukh Khan
date: 2026-05-19
license: MIT
tags:
  - attack.defense-impairment
  - attack.privilege-escalation
  - attack.t1484.001

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection_sysvol_policy_file:
    TargetFilename|contains|all:
      - '\SYSVOL\'
      - '\Policies\'
    TargetFilename|endswith:
      - '\GPT.INI'
      - '\Registry.pol'
      - '\GptTmpl.inf'
      - '\ScheduledTasks.xml'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection_sysvol_policy_file and not filter_system_account

falsepositives:
  - Legitimate GPO administration via GPMC or scripted deployment, and SYSVOL replication.

level: medium

Related sub-techniques

Explore