VOID MANTICOREG1055 ↗
Had utilized Group Policy logon scripts to distribute the malicious payloads to victim devices through the execution of a batch file.1
tfMITRE ATT&CK sub-technique
Group Policy Modification T1484.001
sub-technique of T1484 Domain or Tenant Policy Modification
- Platform
- Windows
- Version
- 2.0
- Created
- 28 December 2020
- Last modified
- 12 May 2026
- Contributors
- Itamar Mizrahi, Cymptom; Tristan Bennett, Seamless Intelligence
Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain. Group policy allows for centralized management of user and computer settings in Active Directory (AD). GPOs are containers for group policy settings made up of files stored within a predictable network path \<DOMAIN>\SYSVOL\<DOMAIN>\Policies\.[1][2]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
5
Threat groups73rd pct
Threat groups73rd percentile · 73% of ATT&CK techniques have this many threat groups attributed or fewer.3
CampaignsTop 12%
Campaigns88th percentile · 88% of ATT&CK techniques have this many campaigns recorded or fewer.8
Tools & malware72nd pct
Tools & malware72nd percentile · 72% of ATT&CK techniques have this many tools implementing them or fewer.15
Detection rulesTop 16%
Detection rules84th percentile · 84% of ATT&CK techniques have this many detection rules written or fewer.Group Policy Modification MITRE reference T1484.001
73rd pctamong all ATT&CK techniques for number of groups
5 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Storm-0501G1053 ↗
Distributed Group Policy Objects to tamper with security products.1
Cinnamon TempestG1021 ↗
Has used Group Policy to deploy batch scripts for ransomware deployment.1
Indrik SpiderG0119 ↗
APT41G0096 ↗
Used scheduled tasks created via Group Policy Objects (GPOs) to deploy ransomware.1
All 5 groups for this technique
3 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
SharePoint ToolShell ExploitationC0058 ↗
During SharePoint ToolShell Exploitation, threat actors, including Storm-2603, modified group policy to enable ransomware distribution.1
2025 Poland Wiper AttacksC0063 ↗
During the 2025 Poland Wiper Attacks, the adversaries had leveraged Group Policy Objects to distribute wiper malware to victim devices through a network share.1
2022 Ukraine Electric Power AttackC0034 ↗
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Group Policy Objects (GPOs) to deploy and execute malware.1
All 3 campaigns for this technique
8 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
QilinS1242 ↗
Has pushed a scheduled task via a Group Policy Object for payload execution.12
LockBit 3.0S1202 ↗
Can enable options for propogation through Group Policy Objects.1
LockBit 2.0S1199 ↗
Can modify Group Policy to disable Windows Defender and to automatically infect devices in Windows domains.12
PrestigeS1058 ↗
Has been deployed using the Default Domain Group Policy Object from an Active Directory Domain Controller.1
HermeticWiperS0697 ↗
Has the ability to deploy through an infected system's default domain policy.1
MeteorS0688 ↗
Can use group policy to push a scheduled task from the AD to all network machines.1
All 8 software entries for this technique · 6 newest in this preview
Offense vs defense T1484.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 3Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 9
first rule: 2022 Q3 · 3 of 3 campaigns plottedGroup Policy Modification detection strategy DET0305
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Group Policy Modifications via AD Object Changes and File Activity
1 platform
AN0854 · Windows
Adversary modifies GPO containers or files under SYSVOL using LDAP, ADSI, PowerShell (e.g., New-GPOImmediateTask) or GUI tools. This includes directory object changes (e.g., gPCFileSysPath), delegation assignments (SeEnableDelegationPrivilege), and SYSVOL file writes (ScheduledTasks.xml, GptTmpl.inf).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account ModificationDC0010 | WinEventLog:Security | EventCode=4704 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| File ModificationDC0061 | WinEventLog:Security | EventCode=4663, 4670, 4656 |
| Active Directory Object ModificationDC0066 | WinEventLog:Security | EventCode=5136 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ObjectDN | Focus detection on AD paths like CN=Policies,CN=System,DC=domain,DC=com. |
| TargetFilename | Target specific files like ScheduledTasks.xml or GptTmpl.inf in SYSVOL. |
| TimeWindow | Correlate GPO object change and SYSVOL file modification within N seconds. |
| UserContext | Alert on unexpected modification by non-admins or uncommon accounts. |
| CommandLine | Flag usage of GPO manipulation tools like Set-GPRegistryValue, New-GPOImmediateTask. |
AuditM1047
Identify and correct GPO permissions abuse opportunities (ex: GPO modification privileges) using auditing tools such as BloodHound (version 1.5.1 and later).
Consider implementing WMI and security filtering to further tailor which users and computers a GPO will apply to.
Tests2Executorscmd 1 · PowerShell 1Need elevation2 of 2Have prerequisites0Have cleanup2Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition