Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Windows Admon Group Policy Object Created

The following analytic detects the creation of a new Group Policy Object (GPO) using Splunk's Admon data. It identifies events where a new GPO is created, excluding default "New Group Policy Object" entries. Monitoring GPO creation is crucial as adversaries can exploit GPOs to escalate privileges or deploy malware across an Active Directory network. If confirmed malicious, this activity could allow attackers to control system configurations, deploy ransomware, or propagate malware, significantly compromising the network's security.

ATT&CK coverage

Outside the enterprise matrix

T1484.001

Detection requirements

Log source category: windows_active_directory_admon

What the source says

What fires this without an attack behind it

Group Policy Objects are created as part of regular administrative operations, filter as needed.

References

Tagged by the source as

Active Directory Privilege EscalationSneaky Active Directory Persistence TricksEndpointendpointSplunk CloudSplunk EnterpriseSplunk Enterprise Securityendpoint

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.