Cross-source coverage
T1615 / ATT&CK
Group Policy Discovery
17 rules across 6 sources.
From MITRE ATT&CK 19.2
Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment. Group Policy allows for centralized management of user and computer settings in Active Directory (AD). Group policy objects (GPOs) are containers for group policy settings made up of files stored within a predictable network path \<DOMAIN>\SYSVOL\<DOMAIN>\Policies\.
Adversaries may use commands such as gpresult or various publicly available PowerShell functions, such as Get-DomainGPO and Get-DomainGPOLocalGroup, to gather information on Group Policy settings. Adversaries may use this information to shape follow-on behaviors, including determining potential attack paths within the target network as well as opportunities to manipulate Group Policy settings (i.e. Domain or Tenant Policy Modification) for their benefit.
- Tactics
- Discovery
- Platforms
- Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:SysmonWinEventLog:PowerShellNSM:Flow
How MITRE says to detect it DET0055
Detection strategy for Group Policy Discovery on Windows
Windows Analytic 0152
Detection of adversary attempts to enumerate Group Policy settings through suspicious command execution (gpresult), PowerShell enumeration (Get-DomainGPO, Get-DomainGPOLocalGroup), and abnormal LDAP queries targeting groupPolicyContainer objects. Defenders observe unusual process lineage, script execution, or LDAP filter activity against domain controllers.
WinEventLog:SecurityEventCode=4661WinEventLog:SysmonEventCode=1WinEventLog:PowerShellEventCode=4103, 4104, 4105, 4106NSM:Flowquery: High-volume LDAP traffic with filters targeting groupPolicyContainer attributes
socfortress/Wazuh-Rules
6 rules| Detection | Severity | Format |
|---|---|---|
| Sysmon - Event 1: Process creation · Download PowerView Script (T1615) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · gpresult Group Policy Discovery (T1615) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · PowerShell Get-GPO Cmdlet (T1615) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · PowerView Get-DomainGPO (T1615) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · WinPwn GPOAudit Execution (T1615) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · WinPwn GPORemoteAccessPolicy (T1615) | High | Wazuh XML |
SigmaHQ/sigma
5 rules| Detection | Severity | Format |
|---|---|---|
| HackTool - SharpUp PrivEsc Tool Execution | Critical | Sigma |
| Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS | High | Sigma |
| Gpresult Display Group Policy Information | Medium | Sigma |
| Potential Reconnaissance Activity Via GatherNetworkInfo.VBS | Medium | Sigma |
| Suspicious GPO Discovery With Get-GPO | Low | Sigma |
Bert-JanP/Hunting-Queries-Detection-Rules
2 rules| Detection | Severity | Format |
|---|---|---|
| Anomalous Group Policy Discovery | Undefined | KQL |
| MITRE ATT&CK Mapping | Undefined | KQL |
elastic/detection-rules
2 rules| Detection | Severity | Format |
|---|---|---|
| Enumeration Command Spawned via WMIPrvSE | Low | Elastic TOML |
| Group Policy Discovery via Microsoft GPResult Utility | Low | Elastic TOML |
elastic/protections-artifacts
1 rule| Detection | Severity | Format |
|---|---|---|
| Active Directory Data Collection via LDAP | Undefined | Elastic TOML |
splunk/security_content
1 rule| Detection | Severity | Format |
|---|---|---|
| Windows WinPEAS PowerShell Script Execution | Undefined | SPL |