Lion Cipher Lab
Detect malicious Group Policy changes from directory service events (5136 + SYSVOL writes)
- SOC Analyst / Blue Team
- Advanced
- ~90 min
- Free · no account required
Why it matters
Group Policy is how a Windows domain tells every computer what to do: which settings to apply, which scripts to run at startup, which scheduled tasks to create, who may log on. That makes it the most efficient delivery system an intruder can capture. One edit to a policy linked to the Workstations OU, and a scheduled task runs on twelve hundred machines within the next refresh, signed off by the domain itself. MITRE ATT&CK tracks this as T1484.001, Group Policy Modification, and ransomware crews have used it to deploy encryptors domain-wide. The domain controller does record these edits, but…
What you'll learn
- Explaining the two halves of a Group Policy Object: the groupPolicyContainer object in Active Directory and the policy folder on SYSVOL
- Reading Security Event 5136 pairs (Value Deleted / Value Added) on a GPO and decoding versionNumber into its user and computer halves
- Decoding gPCMachineExtensionNames into client-side extension (CSE) GUIDs to see which kind of setting an edit introduced
- Using Event 5145 SYSVOL write events (the WriteData bit, 0x2) to see which policy files were touched
- Grouping raw events into changes and scoring naive, identity-based and layered rules with precision and recall
- Naming the blind spots of GPO-change detection (SACLs, audit volume, stolen admin sessions, file-only edits) and the controls that close them
Steps in this lab
- Why a Group Policy edit is an intruder's best delivery system
- A GPO lives in two places -- the directory object and the SYSVOL folder
- What a policy edit actually writes
- The two events that carry the evidence: 5136 and 5145
- Generate two weeks of invented domain-controller telemetry
- Decode what each change did to the directory object
- The judgement: why 'alert on every GPO change' fails, and what context fixes it
- Group events into changes and score three rules
- Read the false positive and the miss like an analyst
- Honest limits -- what this telemetry cannot see
- Optional: look at the real thing on a lab domain controller you own
- Prevention, and where to take this next