Group Policy Object Modification - Potential Domain Persistence via GPO

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•1

This rule detects unauthorized modifications to sensitive Group Policy Object (GPO) attributes, such as file system paths, version numbers, or extension settings. It monitors Security Event 5136 for changes targeting GPO containers by non-standard administrative accounts, flagging potential attempts to persist access or escalate privileges via GPO tampering.