Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Windows Default Domain GPO Modification

Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may modify these default GPOs to deploy malicious configurations across the domain.

ATT&CK coverage

Privilege Escalation

T1484Domain or Tenant Policy ModificationAlso under Defense Impairment.
- T1484.001Group Policy Modification 19 detections cover this technique

Detection requirements

Log source product: windows
Log source service: security

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.