Group Policy Modification
Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain. Group policy allows for centralized management of user and computer settings in Active Directory (AD). GPOs are containers for group policy settings made up of files stored within a predictable network path `\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\`.(Citation: TechNet Group Policy Basics)(Citation: ADSecurity GPO Pers...
BY SOURCE
PROCEDURES (12)
Auto-extracted: 3 detections for authentication monitoring
Auto-extracted: 2 detections for privilege
Auto-extracted: 2 detections for process creation monitoring
Auto-extracted: 2 detections for startup
Auto-extracted: 2 detections for persist
Auto-extracted: 1 detections for general monitoring
Auto-extracted: 1 detections for scheduled task
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for script execution monitoring
Auto-extracted: 1 detections for scheduled task
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for ransomware