PROD (TM012.1) - GPO - Enforced Outside of Tier Model

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

Enforcing of a GPO could bypass or override Tier Model GPOs.

Attribute	Value
Type	Analytic Rule
Solution	Microsoft Active Directory Tier Model
ID	05846968-15cc-4309-bddc-eaa296f84af1
Severity	High
Status	Available
Kind	Scheduled
Tactics	DefenseEvasion
Techniques	T1484.001
Required Connectors	SecurityEvents, WindowsSecurityEvents
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Selection Criteria	Transformations	Ingestion API	Lake-Only
SecurityEvent	Activity has "modified" EventData has ";0]" EventData has ";1]" EventData has ";2]" EventData has "<Data Name=" EventID == "5136"	✓	✓	✓

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Analytic Rules · Back to Microsoft Active Directory Tier Model