Bert-Jan Pals unknown stable kql

Anomalous Group Policy Discovery

Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment. Group policies may contain valueble information for an attacker. This query detects when an device performs an group policy Discovery that has not been performed from that device in the last 30 days. Potential false positive is a new Administrator that has not performed group policy discovery before.

View Source

Detection Logic

let PreviousActivity = materialize (
     IdentityQueryEvents
| where TimeGenerated > ago(30d)
| where QueryType == "AllGroupPolicies"
| summarize make_set(DeviceName)
     );
IdentityQueryEvents
| where TimeGenerated > ago(1d)
| where QueryType == "AllGroupPolicies"
| where not(DeviceName has_any(PreviousActivity))

Field Validations

Loading…

Comments (0)

Loading comments...