Detecting Malicious Group Policy Modification (T1484.001)

Group Policy is the most efficient software distribution system most organizations own. T1484.001, Group Policy Modification, is what happens when someone else uses it. MITRE files it under defense impairment and privilege escalation, for Windows.

How attackers use it

GPOs are containers for group policy settings, and their files live in a predictable network path under the domain's SYSVOL share, in a Policies folder. Like other Active Directory objects, GPOs have access controls. By default all user accounts in the domain can read them, and write access can be delegated to specific users or groups.

Anyone who can write to a GPO can change what many machines do. MITRE lists scheduled tasks, disabling or modifying security tools, ingress tool transfer, account creation and service execution as things malicious GPO changes can implement.

MITRE names a publicly available script, New-GPOImmediateTask, that automates creating a malicious scheduled task by editing the ScheduledTasks.xml file in a GPO's preferences. In other cases, an adversary may modify user rights such as SeEnableDelegationPrivilege, set in the security template file under the GPO.

MITRE's procedure examples show the real world use: GPOs used to deploy malware in an attack on Ukrainian power infrastructure, a GPO linked network share used to push wiper malware in 2025 attacks in Poland, and GPO created scheduled tasks used to deploy ransomware.

How to detect it

MITRE's detection strategy watches for GPO changes in two places at once: Active Directory objects and files in SYSVOL. It covers changes made through LDAP, ADSI, PowerShell or GUI tools, and watches for:

• changes to directory object attributes, such as the GPO's file system path attribute
• new delegation grants, such as the SeEnableDelegationPrivilege user right
• writes to SYSVOL policy files, such as scheduled task XML files and security template (GptTmpl.inf) files

MITRE does not list event IDs for this technique, so configure directory service change auditing and file auditing on the policy store, and send both to your central log platform. Alert on any change to a GPO outside a change window, and treat a new immediate scheduled task in a GPO as high priority.

How to reduce the risk

MITRE lists two mitigations.

1. Audit. Find and fix GPO permission abuse opportunities, such as who has modification rights, with tools like BloodHound version 1.5.1 and later.
2. User account management. Use WMI and security filtering to tailor which users and computers a GPO applies to.

Also keep the number of people with GPO edit rights small, and separate who can edit a policy from who can link it to the whole domain.

Check your own environment

• List principals with write access to each GPO and link. Question every non administrator.
• Confirm that auditing is on for GPO objects and the policy folder in SYSVOL.
• Search SYSVOL for scheduled task preference files and confirm each is expected.
• Check that rights such as SeEnableDelegationPrivilege are assigned only where you intend.

Quick check

Sources

• MITRE ATT&CK T1484.001: Group Policy Modification