Cross-source coverage

T1552.006 / ATT&CK

Unsecured Credentials: Group Policy Preferences

11 rules across 5 sources.

Showing deprecated rules · back to the default

From MITRE ATT&CK 19.2

Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts.

These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public).

The following tools and scripts can be used to gather and decrypt the password file from Group Policy Preference XML files:

  • Metasploit’s post exploitation module: post/windows/gather/credentials/gpp
  • Get-GPPPassword
  • gpprefdecrypt.py

On the SYSVOL share, adversaries may use the following command to enumerate potential GPP XML files: dir /s *.xml

Platforms
Windows
Telemetry
WinEventLog:SysmonWinEventLog:SecurityWinEventLog:PowerShell

How MITRE says to detect it DET0381

Detect Access and Decryption of Group Policy Preference (GPP) Credentials in SYSVOL

Windows Analytic 1075

Correlates file enumeration of XML files in the SYSVOL share with suspicious process execution that decodes or reads encrypted credentials embedded in Group Policy Preference files (e.g., Get-GPPPassword.ps1, gpprefdecrypt.py, Metasploit). Detects abnormal access to \DOMAIN\SYSVOL combined with XML file parsing or decryption logic.

  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Security EventCode=5145
  • WinEventLog:PowerShell Scripts with references to XML parsing, AES decryption, or gpprefdecrypt logic

View on attack.mitre.org ↗

SigmaHQ/sigma

6 rules
Detection Severity Format
Findstr GPP Passwords High Sigma
LSASS Process Reconnaissance Via Findstr.EXE High Sigma
Access To Potentially Sensitive Sysvol Files By Uncommon Applications Medium Sigma
Access To Sysvol Policies Share By Uncommon Process Medium Sigma
Permission Misconfiguration Reconnaissance Via Findstr.EXE Medium Sigma
Suspicious SYSVOL Domain Group Policy Access Medium Sigma

splunk/security_content

2 rules
Detection Severity Format
Windows Findstr GPP Discovery Undefined SPL
Windows PowerSploit GPP Discovery Undefined SPL

chronicle/detection-rules

1 rule
Detection Severity Format
fireeye_red_team_tool__adpasshunt_via_cmdline Undefined YARA-L

elastic/detection-rules

1 rule
Detection Severity Format
Potential PowerShell HackTool Script by Function Names Medium Elastic TOML

socfortress/Wazuh-Rules

1 rule
Detection Severity Format
Powershell script: GPP Password extraction detected High Wazuh XML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.