Group Policy Modification Incident Response Playbook
This download includes the 6clicks Incident Response playbook for Group Policy Modification
The purpose of a Cyber Security Playbook, or Security Playbook, is to provide all members of an organisation with a clear understanding of their roles and responsibilities regarding cybersecurity â before, during and after a security incident.
Adversaries may modify the configuration settings of a domain to evade defenses and/or escalate privileges in domain environments. Domains provide a centralized means of managing how computer resources (ex: computers, user accounts) can act, and interact with each other, on a network.
The policy of the domain also includes configuration settings that may apply between domains in a multi-domain/forest environment. Modifications to domain settings may include altering domain Group Policy Objects (GPOs) or changing trust settings for domains, including federation trusts.
This playbook contains information in the following areas:
- Preparation
- Detection
- Remediation
- Communication
- Post Incident Recovery
Sector(s):
- All
Jurisdiction(s):
- All
