Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

BlackSuit – GPO Change Enabling RDP Across Multiple Hosts

Blacksuit Persistence Sentinel
MITRE ATT&CK
Group Policy Modification
Data Source
SecurityEvent
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools/ttps dataset (blacksuit)
What This Detects
BlackSuit (Royal's successor) has been observed pushing a Group Policy change that enables RDP (fDenyTSConnections) domain-wide shortly before lateral movement – mirrors the GPO-abuse pattern documented in its Royal lineage.
Query
let gpoChange = SecurityEvent
| where TimeGenerated > ago(1d)
| where EventID in (5136, 5137) and ObjectClass == "groupPolicyContainer"
| project GpoChangeTime = TimeGenerated, SubjectAccount;
let rdpEnable = SecurityEvent
| where TimeGenerated > ago(1d)
| where EventID == 4657 and ObjectName has "fDenyTSConnections"
| project RdpEnableTime = TimeGenerated, Computer;
gpoChange
| join kind=inner rdpEnable on $left.SubjectAccount == $right.Computer
| where RdpEnableTime - GpoChangeTime between (0min .. 1h)
| summarize AffectedHosts = dcount(Computer) by SubjectAccount, bin(GpoChangeTime, 1h)
| where AffectedHosts > 3

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.