Tool

github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0025_windows_audit_directory_service_changes.md

https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0025_windows_audit_directory_service_changes.md

Published on: github.com

ATT&CK techniques those detections carry

T1484Domain or Tenant Policy Modification
T1484.001Group Policy Modification
T1037Boot or Logon Initialization Scripts
T1053Scheduled Task/Job
T1053.005Scheduled Task
T1547Boot or Logon Autostart Execution
T1570Lateral Tool Transfer

Open the original

3 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
Detection	Severity	Source	Published	Licence
Scheduled Task Execution at Scale via GPO	Medium	Elastic detection rules	Oct 8, 2026	Elastic License 2.0
Startup/Logon Script added to Group Policy Object	Medium	Elastic detection rules	Oct 8, 2026	Elastic License 2.0
Group Policy Abuse for Privilege Addition	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0

Showing 3 of 3

Filter in the catalogue