CmdID / Techniques / T1484

T1484.001 Domain or Tenant Policy Modification: Group Policy Modification

Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain. MITRE ATT&CK

2 Sigma rules T1484.001 on attack.mitre.org