Add and Enhance Windows GPO & RDP Tampering Detection Rules

[tropChaud]

Summary of the Pull Request

New rules related to recent reported ransom group activity (The Gentlemen, and some similar to previously reported activity)

Changelog

new: Windows Default Domain GPO Modification
new: Windows Default Domain GPO Modification via GPME
update: Potential Tampering With RDP Related Registry Keys Via Reg.EXE - Add coverage for SecurityLayer value
update: RDP Sensitive Settings Changed - Add coverage for SecurityLayer value

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[Copilot]

Pull Request Overview

This PR introduces detection rules for ransomware-related activities associated with The Gentlemen ransomware group and similar threat actors. The rules focus on detecting RDP security weakening through registry modifications and unauthorized Group Policy Object (GPO) changes.

Key changes include:

• Detection of RDP SecurityLayer registry tampering through both registry monitoring and process creation events
• Detection of suspicious modifications to default domain GPOs via Group Policy Management Editor
• Detection of default domain GPO modifications through Windows Security event logs

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
registry_set_rdp_securitylayer.yml	Detects registry changes to RDP SecurityLayer values that weaken authentication
proc_creation_win_reg_rdp_securitylayer.yml	Detects command-line registry modifications to RDP SecurityLayer settings
proc_creation_win_default_domain_gpo_modification_via_gpme.yml	Detects use of GPME to modify default domain GPOs
win_security_default_domain_gpo_modification.yml	Detects Event ID 5136 modifications to default domain GPOs
known-FPs.csv	Adds false positive exception for GPO modification rule

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[nasbench]

Will review

[phantinuss]

@tropChaud: Can you provide example events for each rule?

[nasbench]

@tropChaud: Can you provide example events for each rule?

Checked the rules except for the SACL one that swach suggested. Which I assume he did test it. So we should be good to go.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.