LiveActive security incident?Get immediate response
MITRE ATT&CK® Technique

T1484.001: Group Policy Modification

Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain. Group policy allows for centralized management of user and computer settings in Active Directory (AD). GPOs are containers for group policy settings made up of files stored within a predictable network path `\\SYSVOL\\Policies\`.[1][2]

Like other objects in AD, GPOs have access controls associated with them. By default all user accounts in the domain have permission to read GPOs. It is possible to delegate GPO access control permissions, e.g. write access, to specific users or groups in the domain.

Malicious GPO modifications can be used to implement many other malicious behaviors such as Scheduled Task/Job, Disable or Modify Tools, Ingress Tool Transfer, Create Account, Service Execution, and more.[2][3][4][5][6] Since GPOs can control so many user and machine settings in the AD environment, there are a great number of potential attacks that can stem from this GPO abuse.[3]

For example, publicly available scripts such as New-GPOImmediateTask can be leveraged to automate the creation of a malicious Scheduled Task/Job by modifying GPO settings, in this case modifying <GPO_PATH>\Machine\Preferences\ScheduledTasks\ScheduledTasks.xml.[3][4] In some cases an adversary might modify specific user rights like SeEnableDelegationPrivilege, set in <GPO_PATH>\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf, to achieve a subtle AD backdoor with complete control of the domain because the user account under the adversary's control would then be able to modify GPOs.[7]

EnterpriseT1484.001Sub-techniqueObject v2.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Group Policy modification matters because GPOs are a Windows Active Directory control plane: one unauthorized change can alter settings across many users or computers. For leaders, this is not just an admin change-monitoring issue; it is a domain resilience issue tied to privilege escalation and defense impairment.

Executive priority

Prioritize this where Windows Active Directory is central to business operations. Executives should ask who can modify GPOs, how those permissions are reviewed, whether GPO and SYSVOL changes are audited, and how quickly IR can identify and roll back unauthorized policy changes. The relationship context includes ransomware, wiper, criminal, and state-linked activity using this behavior, including campaigns involving energy and electric-sector environments, making it relevant to operational continuity and cyber-physical risk where AD-managed systems support critical operations.

Technical view

Validate monitoring for both Active Directory object changes and file activity in SYSVOL, consistent with DET0305. Focus on GPO permission changes, delegated write access, and edits under \\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\. Pay particular attention to policy artifacts called out by ATT&CK such as Machine\Preferences\ScheduledTasks\ScheduledTasks.xml and MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf, including changes to sensitive rights such as SeEnableDelegationPrivilege. SOC and IR teams should correlate the modifying account, source host, affected GPO, linked OUs, and downstream machines/users that would receive the policy.

Likely telemetry

  • Active Directory audit records for GPO object creation, modification, deletion, ownership, and ACL/delegation changes
  • SYSVOL file and directory modification activity on domain controllers
  • Changes to GPO policy files such as ScheduledTasks.xml and GptTmpl.inf
  • Administrative account activity involving GPO management
  • Directory replication or domain controller logs that can show propagation of policy changes

Detection direction

  • Baseline normal GPO administrators, service accounts, management hosts, and maintenance windows before alerting on all GPO writes.
  • Alert on unexpected GPO ACL changes, new delegated write permissions, ownership changes, or modifications by non-standard accounts.
  • Monitor SYSVOL paths for edits to files that can create scheduled tasks, modify security settings, disable tools, create accounts, or enable service execution behavior.
  • Correlate GPO changes with related ATT&CK behaviors referenced by the object, including Scheduled Task/Job, Disable or Modify Tools, Ingress Tool Transfer, Create Account, and Service Execution.
  • Treat legitimate administration as a major false-positive source; require linkage to change tickets, expected admin hosts, and approved operators.

Mitigation priorities

  • Implement User Account Management controls: restrict GPO modification rights to the smallest necessary set of accounts and groups.
  • Regularly review delegated GPO permissions, especially write access and sensitive user-right assignments.
  • Maintain auditing for GPO object changes and SYSVOL file activity, and review those records systematically for anomalies and compliance evidence.
  • Use formal change control for GPO edits so unauthorized or emergency changes are distinguishable during incident response.
  • Prepare rollback and recovery procedures for unauthorized GPO changes, including understanding which OUs, users, and machines each GPO affects.
Additional notes and limits

This technique is a sub-technique of Domain or Tenant Policy Modification and applies to Windows Active Directory environments. It is especially important because GPOs can be abused as a distribution and persistence mechanism for multiple other behaviors. Relationship context shows use by several campaigns, groups, and software families, including ransomware and wiper-related entries, but local exposure depends on the organization’s AD design and delegated permissions.

The official ATT&CK object does not provide a detection section. Detection guidance here is derived from the official description, the DET0305 relationship naming AD object changes and file activity, and the listed mitigations M1018 User Account Management and M1047 Audit. Environment-specific event IDs, tooling coverage, and response procedures require local validation.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Group Policy Modification

Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain. Group policy allows for centralized management of user and computer settings in Active Directory (AD). GPOs are containers for group policy settings made up of files stored within a predictable network path `\\SYSVOL\\Policies\`.[1][2]

Like other objects in AD, GPOs have access controls associated with them. By default all user accounts in the domain have permission to read GPOs. It is possible to delegate GPO access control permissions, e.g. write access, to specific users or groups in the domain.

Malicious GPO modifications can be used to implement many other malicious behaviors such as Scheduled Task/Job, Disable or Modify Tools, Ingress Tool Transfer, Create Account, Service Execution, and more.[2][3][4][5][6] Since GPOs can control so many user and machine settings in the AD environment, there are a great number of potential attacks that can stem from this GPO abuse.[3]

For example, publicly available scripts such as New-GPOImmediateTask can be leveraged to automate the creation of a malicious Scheduled Task/Job by modifying GPO settings, in this case modifying <GPO_PATH>\Machine\Preferences\ScheduledTasks\ScheduledTasks.xml.[3][4] In some cases an adversary might modify specific user rights like SeEnableDelegationPrivilege, set in <GPO_PATH>\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf, to achieve a subtle AD backdoor with complete control of the domain because the user account under the adversary's control would then be able to modify GPOs.[7]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
DomainIDNameRelationship / procedure
EnterpriseT1484Domain or Tenant Policy ModificationThis object subtechnique of Domain or Tenant Policy Modification.
Associated objects

Groups, software, and campaigns

GroupEnterprise

G1055: VOID MANTICORE

VOID MANTICORE is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS).[1] Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States.[1][2] VOID MANTICORE conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including HomeLand Justice in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation.[1][3] VOID MANTICORE has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity.[4]

GroupEnterprise

G1053: Storm-0501

Storm-0501 is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations. Storm-0501 has been active since 2021 and has previously been affiliated with Sabbath Ransomware and other Ransomware-as-a-Service (RaaS) variants such as Hive, BlackCat, Hunters International, LockBit 3.0, and Embargo ransomware.[1][2][3][4]

GroupEnterprise

G1021: Cinnamon Tempest

Cinnamon Tempest is a China-based threat group that has been active since at least 2021 deploying multiple strains of ransomware based on the leaked Babuk source code. Cinnamon Tempest does not operate their ransomware on an affiliate model or purchase access but appears to act independently in all stages of the attack lifecycle. Based on victimology, the short lifespan of each ransomware variant, and use of malware attributed to government-sponsored threat groups, Cinnamon Tempest may be motivated by intellectual property theft or cyberespionage rather than financial gain.[1][2][3][4]

GroupEnterprise

G0096: APT41

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.[1] Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.[2][3]

MalwareEnterprise

S1058: Prestige

Prestige ransomware has been used by Sandworm Team since at least March 2022, including against transportation and related logistics industries in Ukraine and Poland in October 2022.[1]

Windows
MalwareEnterprise

S1202: LockBit 3.0

LockBit 3.0 is an evolution of the LockBit Ransomware-as-a-Service (RaaS) offering with similarities to BlackMatter and BlackCat ransomware. LockBit 3.0 has been in use since at least June 2022 and features enhanced defense evasion and exfiltration tactics, robust encryption methods for Windows and VMware ESXi systems, and a more refined RaaS structure over its predecessors such as LockBit 2.0.[1][2][3][4]

Windows
MalwareEnterprise

S0697: HermeticWiper

HermeticWiper is a data wiper that has been used since at least early 2022, primarily against Ukraine with additional activity observed in Latvia and Lithuania. Some sectors targeted include government, financial, defense, aviation, and IT services.[1][2][3][4][5]

Windows
ToolEnterprise

S0363: Empire

Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure PowerShell for Windows and Python for Linux/macOS. Empire was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.[1][2][3]

LinuxmacOSWindows
MalwareEnterprise

S1199: LockBit 2.0

LockBit 2.0 is an affiliate-based Ransomware-as-a-Service (RaaS) that has been in use since at least June 2021 as the successor to LockBit Ransomware. LockBit 2.0 has versions capable of infecting Windows and VMware ESXi virtual machines, and has been observed targeting multiple industry verticals globally.[1][2]

Windows
MalwareEnterprise

S1242: Qilin

Qilin is a ransomware family operated as a ransomware-as-a-service (RaaS) that has been active since at least 2022. It includes variants written in Go and Rust capable of targeting Windows, Linux, and VMware ESXi environments. Qilin shares functionality overlaps with Black Basta, REvil, and BlackCat ransomware. Qilin affiliates have targeted multiple entities worldwide with the majority of victims in the US, France, Canada, and the UK, primarily in the manufacturing, technology, financial services, and healthcare sectors.[1][2][3][4][5]

ESXiWindowsLinux
MalwareEnterprise

S0554: Egregor

Egregor is a Ransomware-as-a-Service (RaaS) tool that was first observed in September 2020. Researchers have noted code similarities between Egregor and Sekhmet ransomware, as well as Maze ransomware.[1][2][3]

Windows
MalwareEnterprise

S0688: Meteor

Meteor is a wiper that was used against Iranian government organizations, including Iranian Railways, the Ministry of Roads, and Urban Development systems, in July 2021. Meteor is likely a newer version of similar wipers called Stardust and Comet that were reportedly used by a group called "Indra" since at least 2019 against private companies in Syria.[1]

Windows
CampaignEnterprise

C0063: 2025 Poland Wiper Attacks

2025 Poland Wiper Attacks is a Russian state-sponsored campaign that conducted destructive cyberattacks against Polish energy infrastructure in December 2025. Targets included more than 30 wind and photovoltaic farms, a combined heat and power (CHP) plant, and a manufacturing sector company. The attacks on the distributed energy resources (DER) disrupted communications between affected facilities and the distribution system operator, but did not impact electricity generation or heat supply. Across the campaign, threat actors deployed two previously undocumented wiper tools, DynoWiper, a Windows-based wiper and LazyWiper, a PowerShell wiper, distributed via malicious Group Policy Objects. At the CHP plant, threat actors had maintained access since at least March 2025, using that foothold to obtain credentials and move laterally before attempting wiper deployment. Some reporting has assessed the activity to be consistent with Russian Federal Security Service (FSB) threat activity group Dragonfly, also tracked as STATIC TUNDRA, while other reporting attributes the destructive wiper activities to the Russian General Staff Main Intelligence Directorate (GRU) threat activity group ELECTRUM, also tracked as Sandworm Team.[1][2][3][4]

CampaignEnterprise

C0058: SharePoint ToolShell Exploitation

The SharePoint ToolShell Exploitation campaign was conducted in July 2025 and encompassed the first waves of exploitation against incompletely patched spoofing (CVE-2025-49706) and remote code execution (CVE-2025-49704) vulnerabilities affecting on-premises Microsoft SharePoint servers. Later patched and updated as CVE-2025-53770 and CVE-2025-53771, the ToolShell vulnerabilities were widely exploited including by China-based ransomware actor Storm-2603 and espionage actors Threat Group-3390 and ZIRCONIUM. SharePoint ToolShell Exploitation targeted multiple regions and industries including finance, education, energy, and healthcare across Asia, Europe, and the United States.[1][2][3][4][5]

Relationship explorer

All related ATT&CK context

uses · CampaignC0063: 2025 Poland Wiper AttacksEnterpriseuses · MalwareS1058: PrestigeEnterpriseuses · MalwareS1202: LockBit 3.0Enterprisemitigates · MitigationM1047: AuditEnterpriseuses · GroupG1055: VOID MANTICOREEnterpriseuses · GroupG1053: Storm-0501Enterpriseuses · MalwareS0697: HermeticWiperEnterpriseuses · GroupG1021: Cinnamon TempestEnterpriseuses · ToolS0363: EmpireEnterpriseuses · CampaignC0058: SharePoint ToolShell ExploitationEnterpriseuses · GroupG0096: APT41Enterprisemitigates · MitigationM1018: User Account ManagementEnterpriseuses · MalwareS1199: LockBit 2.0Enterpriseuses · GroupG0119: Indrik SpiderEnterprisedetects · Detection StrategyDET0305: Detection of Group Policy Modifications via AD Object Changes and File ActivityEnterpriseuses · MalwareS1242: QilinEnterprisesubtechnique of · TechniqueT1484: Domain or Tenant Policy ModificationEnterpriseuses · MalwareS0554: EgregorEnterpriseuses · MalwareS0688: MeteorEnterpriseuses · CampaignC0034: 2022 Ukraine Electric Power AttackEnterprise
Mitigations

Mitigation direction

MitigationEnterprise

M1047: Audit

Auditing is the process of recording activity and systematically reviewing and analyzing the activity and system configurations. The primary purpose of auditing is to detect anomalies and identify potential threats or weaknesses in the environment. Proper auditing configurations can also help to meet compliance requirements. The process of auditing encompasses regular analysis of user behaviors and system logs in support of proactive security measures.

Auditing is applicable to all systems used within an organization, from the front door of a building to accessing a file on a fileserver. It is considered more critical for regulated industries such as, healthcare, finance and government where compliance requirements demand stringent tracking of user and system activates.This mitigation can be implemented through the following measures:

System Audit:

- Use Case: Regularly assess system configurations to ensure compliance with organizational security policies. - Implementation: Use tools to scan for deviations from established benchmarks.

Permission Audits:

- Use Case: Review file and folder permissions to minimize the risk of unauthorized access or privilege escalation. - Implementation: Run access reviews to identify users or groups with excessive permissions.

Software Audits:

- Use Case: Identify outdated, unsupported, or insecure software that could serve as an attack vector. - Implementation: Use inventory and vulnerability scanning tools to detect outdated versions and recommend secure alternatives.

Configuration Audits:

- Use Case: Evaluate system and network configurations to ensure secure settings (e.g., disabled SMBv1, enabled MFA). - Implementation: Implement automated configuration scanning tools like SCAP (Security Content Automation Protocol) to identify non-compliant systems.

Network Audits:

- Use Case: Examine network traffic, firewall rules, and endpoint communications to identify unauthorized or insecure connections. - Implementation: Utilize tools such as Wireshark, or Zeek to monitor and log suspicious network behavior.

MitigationEnterprise

M1018: User Account Management

User Account Management involves implementing and enforcing policies for the lifecycle of user accounts, including creation, modification, and deactivation. Proper account management reduces the attack surface by limiting unauthorized access, managing account privileges, and ensuring accounts are used according to organizational policies. This mitigation can be implemented through the following measures:

Enforcing the Principle of Least Privilege

- Implementation: Assign users only the minimum permissions required to perform their job functions. Regularly audit accounts to ensure no excess permissions are granted. - Use Case: Reduces the risk of privilege escalation by ensuring accounts cannot perform unauthorized actions.

Implementing Strong Password Policies

- Implementation: Enforce password complexity requirements (e.g., length, character types). Require password expiration every 90 days and disallow password reuse. - Use Case: Prevents adversaries from gaining unauthorized access through password guessing or brute force attacks.

Managing Dormant and Orphaned Accounts

- Implementation: Implement automated workflows to disable accounts after a set period of inactivity (e.g., 30 days). Remove orphaned accounts (e.g., accounts without an assigned owner) during regular account audits. - Use Case: Eliminates dormant accounts that could be exploited by attackers.

Account Lockout Policies

- Implementation: Configure account lockout thresholds (e.g., lock accounts after five failed login attempts). Set lockout durations to a minimum of 15 minutes. - Use Case: Mitigates automated attack techniques that rely on repeated login attempts.

Multi-Factor Authentication (MFA) for High-Risk Accounts

- Implementation: Require MFA for all administrative accounts and high-risk users. Use MFA mechanisms like hardware tokens, authenticator apps, or biometrics. - Use Case: Prevents unauthorized access, even if credentials are stolen.

Restricting Interactive Logins

- Implementation: Restrict interactive logins for privileged accounts to specific secure systems or management consoles. Use group policies to enforce logon restrictions. - Use Case: Protects sensitive accounts from misuse or exploitation.

*Tools for Implementation*

Built-in Tools:

- Microsoft Active Directory (AD): Centralized account management and RBAC enforcement. - Group Policy Object (GPO): Enforce password policies, logon restrictions, and account lockout policies.

Identity and Access Management (IAM) Tools:

- Okta: Centralized user provisioning, MFA, and SSO integration. - Microsoft Azure Active Directory: Provides advanced account lifecycle management, role-based access, and conditional access policies.

Privileged Account Management (PAM): - CyberArk, BeyondTrust, Thycotic: Manage and monitor privileged account usage, enforce session recording, and JIT access.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
2.0
Created
Modified
Raw hash
b5521c6a2f499d48...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.12.0Current bundleb5521c6a2f49…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    TechNet Group Policy Basics

    srachui. (2012, February 13). Group Policy Basics – Part 1: Understanding the Structure of a Group Policy Object. Retrieved March 5, 2019.

    Open source URL
  2. [2]
    ADSecurity GPO Persistence 2016

    Metcalf, S. (2016, March 14). Sneaky Active Directory Persistence #17: Group Policy. Retrieved March 5, 2019.

    Open source URL
  3. [3]
    Wald0 Guide to GPOs

    Robbins, A. (2018, April 2). A Red Teamer’s Guide to GPOs and OUs. Retrieved March 5, 2019.

    Open source URL
  4. [4]
    Harmj0y Abusing GPO Permissions

    Schroeder, W. (2016, March 17). Abusing GPO Permissions. Retrieved September 23, 2024.

    Open source URL
  5. [5]
    Mandiant M Trends 2016

    Mandiant. (2016, February 25). Mandiant M-Trends 2016. Retrieved November 17, 2024.

    Open source URL
  6. [6]
    Microsoft Hacking Team Breach

    Microsoft Secure Team. (2016, June 1). Hacking Team Breach: A Cyber Jurassic Park. Retrieved March 5, 2019.

    Open source URL
  7. [7]
    Harmj0y SeEnableDelegationPrivilege Right

    Schroeder, W. (2017, January 10). The Most Dangerous User Right You (Probably) Have Never Heard Of. Retrieved September 23, 2024.

    Open source URL
  8. [8]
    CERT Polska

    CERT Polska. (2026, January 30). Energy Sector Incident Report – 29 December. Retrieved April 22, 2026.

    Open source URL
  9. [9]
    Microsoft Prestige ransomware October 2022

    MSTIC. (2022, October 14). New “Prestige” ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023.

    Open source URL
  10. [10]
    Joint Cybersecurity Advisory LockBit 3.0 MAR 2023

    FBI et al. (2023, March 16). #StopRansomware: LockBit 3.0. Retrieved February 5, 2025.

    Open source URL
  11. [11]
    GitHub Bloodhound

    Robbins, A., Vazarkar, R., and Schroeder, W. (2016, April 17). Bloodhound: Six Degrees of Domain Admin. Retrieved March 5, 2019.

    Open source URL
  12. [12]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  13. [13]
    Microsoft Storm-501 Sabbath Ransomware Embargo September 2024

    Microsoft Threat Intelligence. (2024, September 26). Storm-0501: Ransomware attacks expanding to hybrid cloud environments. Retrieved October 19, 2025.

    Open source URL
  14. [14]
    ESET Hermetic Wizard March 2022

    ESET. (2022, March 1). IsaacWiper and HermeticWizard: New wiper and worm targetingUkraine. Retrieved April 10, 2022.

    Open source URL
  15. [15]
    Microsoft Ransomware as a Service

    Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.

    Open source URL
  16. [16]
    Github PowerShell Empire

    Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.

    Open source URL
  17. [17]
    Microsoft SharePoint Exploit JUL 2025

    Microsoft Threat Intelligence. (2025, July 22). Disrupting active exploitation of on-premises SharePoint vulnerabilities. Retrieved October 15, 2025.

    Open source URL
  18. [18]
    apt41_mandiant

    Mandiant. (n.d.). APT41, A DUAL ESPIONAGE AND CYBER CRIME OPERATION. Retrieved June 11, 2024.

    Open source URL
  19. [19]
    Microsoft WMI Filters

    Microsoft. (2008, September 11). Fun with WMI Filters in Group Policy. Retrieved March 13, 2019.

    Open source URL
  20. [20]
    Microsoft GPO Security Filtering

    Microsoft. (2018, May 30). Filtering the Scope of a GPO. Retrieved March 13, 2019.

    Open source URL
  21. [21]
    FBI Lockbit 2.0 FEB 2022

    FBI. (2022, February 4). Indicators of Compromise Associated with LockBit 2.0 Ransomware. Retrieved January 24, 2025.

    Open source URL
  22. [22]
    Palo Alto Lockbit 2.0 JUN 2022

    Elsad, A. et al. (2022, June 9). LockBit 2.0: How This RaaS Operates and How to Protect Against It. Retrieved January 24, 2025.

    Open source URL
  23. [23]
    Crowdstrike Indrik November 2018

    Frankoff, S., Hartley, B. (2018, November 14). Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware. Retrieved January 6, 2021.

    Open source URL
  24. [24]
    Mandiant_UNC2165

    Mandiant Intelligence. (2022, June 2). To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions. Retrieved July 29, 2024.

    Open source URL
  25. [25]
    Trend Micro Agenda Ransomware AUG 2022

    Magdy, S. et al. (2022, August 25). New Golang Ransomware Agenda Customizes Attacks. Retrieved September 26, 2025.

    Open source URL
  26. [26]
    BushidoToken Qilin RaaS JUN 2024

    Thomas, W. (2024, June 12). Tracking Adversaries: The Qilin RaaS. Retrieved September 26, 2025.

    Open source URL
  27. [27]
    Cybereason Egregor Nov 2020

    Rochberger, L. (2020, November 26). Cybereason vs. Egregor Ransomware. Retrieved December 30, 2020.

    Open source URL
  28. [28]
    Intrinsec Egregor Nov 2020

    Bichet, J. (2020, November 12). Egregor – Prolock: Fraternal Twins ?. Retrieved January 6, 2021.

    Open source URL
  29. [29]
    Check Point Meteor Aug 2021

    Check Point Research Team. (2021, August 14). Indra - Hackers Behind Recent Attacks on Iran. Retrieved February 17, 2022.

    Open source URL
  30. [30]
    Mandiant-Sandworm-Ukraine-2022

    Ken Proska, John Wolfram, Jared Wilson, Dan Black, Keith Lunden, Daniel Kapellmann Zafra, Nathan Brubaker, Tyler Mclellan, Chris Sistrunk. (2023, November 9). Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology. Retrieved March 28, 2024.

    Open source URL
  31. [31]
    ADSecurity GPO Persistence 2016

    Metcalf, S. (2016, March 14). Sneaky Active Directory Persistence #17: Group Policy. Retrieved March 5, 2019.

    Open source URL
  32. [32]
    ADSecurity GPO Persistence 2016

    Metcalf, S. (2016, March 14). Sneaky Active Directory Persistence #17: Group Policy. Retrieved March 5, 2019.

    Open source URL
  33. [33]
    Harmj0y Abusing GPO Permissions

    Schroeder, W. (2016, March 17). Abusing GPO Permissions. Retrieved September 23, 2024.

    Open source URL
  34. [34]
    Harmj0y Abusing GPO Permissions

    Schroeder, W. (2016, March 17). Abusing GPO Permissions. Retrieved September 23, 2024.

    Open source URL
  35. [35]
    Harmj0y SeEnableDelegationPrivilege Right

    Schroeder, W. (2017, January 10). The Most Dangerous User Right You (Probably) Have Never Heard Of. Retrieved September 23, 2024.

    Open source URL
  36. [36]
    Harmj0y SeEnableDelegationPrivilege Right

    Schroeder, W. (2017, January 10). The Most Dangerous User Right You (Probably) Have Never Heard Of. Retrieved September 23, 2024.

    Open source URL
  37. [37]
    Mandiant M Trends 2016

    Mandiant. (2016, February 25). Mandiant M-Trends 2016. Retrieved November 17, 2024.

    Open source URL
  38. [38]
    Mandiant M Trends 2016

    Mandiant. (2016, February 25). Mandiant M-Trends 2016. Retrieved November 17, 2024.

    Open source URL
  39. [39]
    Microsoft Hacking Team Breach

    Microsoft Secure Team. (2016, June 1). Hacking Team Breach: A Cyber Jurassic Park. Retrieved March 5, 2019.

    Open source URL
  40. [40]
    Microsoft Hacking Team Breach

    Microsoft Secure Team. (2016, June 1). Hacking Team Breach: A Cyber Jurassic Park. Retrieved March 5, 2019.

    Open source URL
  41. [41]
    TechNet Group Policy Basics

    srachui. (2012, February 13). Group Policy Basics – Part 1: Understanding the Structure of a Group Policy Object. Retrieved March 5, 2019.

    Open source URL
  42. [42]
    TechNet Group Policy Basics

    srachui. (2012, February 13). Group Policy Basics – Part 1: Understanding the Structure of a Group Policy Object. Retrieved March 5, 2019.

    Open source URL
  43. [43]
    Wald0 Guide to GPOs

    Robbins, A. (2018, April 2). A Red Teamer’s Guide to GPOs and OUs. Retrieved March 5, 2019.

    Open source URL
  44. [44]
    Wald0 Guide to GPOs

    Robbins, A. (2018, April 2). A Red Teamer’s Guide to GPOs and OUs. Retrieved March 5, 2019.

    Open source URL
  45. [45]
    mitre-attackT1484.001
    Open source URL
  46. [46]
    mitre-attackT1484.001
    Open source URL
  47. [47]
    mitre-attackT1484.001
    Open source URL
  48. [48]
    CERT Polska

    CERT Polska. (2026, January 30). Energy Sector Incident Report – 29 December. Retrieved April 22, 2026.

    Open source URL
  49. [49]
    Microsoft Prestige ransomware October 2022

    MSTIC. (2022, October 14). New “Prestige” ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023.

    Open source URL
  50. [50]
    Joint Cybersecurity Advisory LockBit 3.0 MAR 2023

    FBI et al. (2023, March 16). #StopRansomware: LockBit 3.0. Retrieved February 5, 2025.

    Open source URL
  51. [51]
    GitHub Bloodhound

    Robbins, A., Vazarkar, R., and Schroeder, W. (2016, April 17). Bloodhound: Six Degrees of Domain Admin. Retrieved March 5, 2019.

    Open source URL
  52. [52]
    Check Point VOID MANTICORE Handala Hack March 2026

    Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.

    Open source URL
  53. [53]
    Microsoft Storm-501 Sabbath Ransomware Embargo September 2024

    Microsoft Threat Intelligence. (2024, September 26). Storm-0501: Ransomware attacks expanding to hybrid cloud environments. Retrieved October 19, 2025.

    Open source URL
  54. [54]
    ESET Hermetic Wizard March 2022

    ESET. (2022, March 1). IsaacWiper and HermeticWizard: New wiper and worm targetingUkraine. Retrieved April 10, 2022.

    Open source URL
  55. [55]
    Microsoft Ransomware as a Service

    Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.

    Open source URL
  56. [56]
    Github PowerShell Empire

    Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.

    Open source URL
  57. [57]
    Microsoft SharePoint Exploit JUL 2025

    Microsoft Threat Intelligence. (2025, July 22). Disrupting active exploitation of on-premises SharePoint vulnerabilities. Retrieved October 15, 2025.

    Open source URL
  58. [58]
    apt41_mandiant

    Mandiant. (n.d.). APT41, A DUAL ESPIONAGE AND CYBER CRIME OPERATION. Retrieved June 11, 2024.

    Open source URL
  59. [59]
    Microsoft GPO Security Filtering

    Microsoft. (2018, May 30). Filtering the Scope of a GPO. Retrieved March 13, 2019.

    Open source URL
  60. [60]
    Microsoft WMI Filters

    Microsoft. (2008, September 11). Fun with WMI Filters in Group Policy. Retrieved March 13, 2019.

    Open source URL
  61. [61]
    Wald0 Guide to GPOs

    Robbins, A. (2018, April 2). A Red Teamer’s Guide to GPOs and OUs. Retrieved March 5, 2019.

    Open source URL
  62. [62]
    Wald0 Guide to GPOs

    Robbins, A. (2018, April 2). A Red Teamer’s Guide to GPOs and OUs. Retrieved March 5, 2019.

    Open source URL
  63. [63]
    FBI Lockbit 2.0 FEB 2022

    FBI. (2022, February 4). Indicators of Compromise Associated with LockBit 2.0 Ransomware. Retrieved January 24, 2025.

    Open source URL
  64. [64]
    Palo Alto Lockbit 2.0 JUN 2022

    Elsad, A. et al. (2022, June 9). LockBit 2.0: How This RaaS Operates and How to Protect Against It. Retrieved January 24, 2025.

    Open source URL
  65. [65]
    Crowdstrike Indrik November 2018

    Frankoff, S., Hartley, B. (2018, November 14). Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware. Retrieved January 6, 2021.

    Open source URL
  66. [66]
    Mandiant_UNC2165

    Mandiant Intelligence. (2022, June 2). To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions. Retrieved July 29, 2024.

    Open source URL
  67. [67]
    BushidoToken Qilin RaaS JUN 2024

    Thomas, W. (2024, June 12). Tracking Adversaries: The Qilin RaaS. Retrieved September 26, 2025.

    Open source URL
  68. [68]
    Trend Micro Agenda Ransomware AUG 2022

    Magdy, S. et al. (2022, August 25). New Golang Ransomware Agenda Customizes Attacks. Retrieved September 26, 2025.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use