Directory
في هذه الصفحة
Directory answers: what did the domain push to this host through Group Policy - and, on a domain controller, who changed GPOs and privileged groups?
At a glance
Question | What the domain pushed to this host through Group Policy. |
Reads | On a domain controller: SYSVOL's GPO folders and files. On a member: Group Policy's own records and copies. On a domain controller also: directory changes, replication rights used, and authentication requests in the Security log. |
Never | Queries the directory. No LDAP, no directory API, no other host contacted. |
Rule prefix |
|
What it reads
Group Policy, on every host
Every GPO (gpo) and everything it deploys (gpo_setting): scheduled tasks, scripts, file copies, services, registry values, group memberships, shortcuts. On a domain controller, from SYSVOL; on a member, from what Group Policy applied and kept. On a domain controller, the executables, installers, scripts and shortcuts in SYSVOL (sysvol_file).
On a domain controller
Source | What it shows |
|---|---|
Security 5136, 5137, 5139, 5141 ( | Who created, edited or linked a GPO; group and delegation changes. |
Security 4662 ( | Replication rights used - DCSync from an account that is not a domain controller. |
Security 4768, 4769, 4771, 4776 ( | Counted, not listed: RC4 service tickets, tickets without pre-authentication, password spraying, NTLM password guessing. |
Signals it raises
25 rules: 7 high, 17 medium, 1 low. The full text of each is in the rule catalog.
ID | Severity | Title | Evidence | ATT&CK |
|---|---|---|---|---|
| high | The AdminSDHolder object was changed |
|
|
| high | Kerberos delegation was set on an account |
|
|
| high | A command to copy or export the directory database |
|
|
| high | A member was added to a domain's most privileged group |
|
|
| high | One account requested RC4 service tickets for several services within an hour | run facts |
|
| high | Directory replication rights used by an account that is not a computer |
|
|
| high | An executable in SYSVOL is named as another kind of file |
|
|
| medium | A GPO's task or script names a web address |
|
|
| medium | A GPO copies an executable or script to hosts |
|
|
| medium | A GPO adds a Microsoft Defender exclusion |
|
|
| medium | A GPO turns a Microsoft Defender protection off |
|
|
| medium | A GPO setting that runs or places a program was written in the period |
|
|
| medium | A GPO defines an immediate task |
|
|
| medium | A GPO was linked to a domain, OU or site |
|
|
| medium | A GPO adds members to the local Administrators group |
|
|
| medium | A GPO disables or stops a backup or recovery service |
|
|
| medium | A GPO runs a program from a folder users can write to |
|
|
| medium | A GPO stores a password |
|
|
| medium | A GPO's task runs a program from a network share |
|
|
| medium | Many wrong passwords for one account within an hour | run facts |
|
| medium | Wrong passwords for many accounts from one source within an hour | run facts |
|
| medium | A member was added to a sensitive domain group |
|
|
| medium | An executable or script in SYSVOL was written in the period |
|
|
| medium | Tickets were issued to accounts that do not require Kerberos pre-authentication | run facts |
|
| low | A GPO was created |
|
|
How to read it
The Group Policy table: every GPO, its links, what it deploys, when it changed, and - on a domain controller - who changed it. A GPO deleted from the domain after it applied still shows on a member.
Telemetry on a domain controller says whether each needed audit subcategory is on. A rule whose events are not audited is not run, never clear.
A domain's creation writes many group and delegation records; Signal leaves them out.
What it can't see
Next
Scope: is this host in scope?