Techniques › T1615
T1615 Group Policy Discovery
discovery — Windows · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
5
Sigma rules tagged attack.t1615
0
KEV CVEs mapped here
<p>Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment. Group Policy allows for centralized management of user and computer settings in Active Directory (AD). Group policy objects (GPOs) are containers for group policy settings made up of files stored within a predictable network path
\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\.</p><p>Adversaries may use commands such as <code>gpresult</code> or various publicly available PowerShell functions, such as <code>Get-DomainGPO</code> and <code>Get-DomainGPOLocalGroup</code>, to gather information on Group Policy settings. Adversaries may use this information to shape follow-on behaviors, including determining potential attack paths within the target network as well as opportunities to manipulate Group Policy settings (i.e. Domain or Tenant Policy Modification) for their benefit.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0055 Detection strategy for Group Policy Discovery on Windows v1.0
AN0152 WindowsDetection of adversary attempts to enumerate Group Policy settings through suspicious command execution (gpresult), PowerShell enumeration (Get-DomainGPO, Get-DomainGPOLocalGroup), and abnormal LDAP queries targeting groupPolicyContainer objects. Defenders observe unusual process lineage, script execution, or LDAP filter activity against domain controllers.NSM:Flow
query: High-volume LDAP traffic with filters targeting groupPolicyContainer attributes→ DC0085 Network Traffic ContentTunable:TimeWindowUserContextCommandLinePatterns
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1615
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-02-08 · logsource: product=windows category=process_creation · 07aa184a-870d-413d-893a-157f317f6f58
Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine
Author: blueteamer8699
· 2022-01-03 (modified 2023-02-08) · logsource: product=windows category=process_creation · 575dce0c-8139-4e30-9295-1ee75969f7fe
Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine
Author: Florian Roth (Nextron Systems)
· 2022-08-20 (modified 2023-02-13) · logsource: product=windows category=process_creation · c484e533-ee16-4a93-b6ac-f0ea4868b2f1
Detects the use of SharpUp, a tool for local privilege escalation
Author: frack113
· 2022-05-01 · logsource: product=windows category=process_creation · e56d3073-83ff-4021-90fe-c658e0709e72
Detects cases in which a user uses the built-in Windows utility gpresult to display the Resultant Set of Policy (RSoP) information
Author: frack113
· 2022-06-04 · logsource: product=windows category=ps_script · eb2fd349-ec67-4caa-9143-d79c7fb34441
Detect use of Get-GPO to get one GPO or all the GPOs in a domain.