{"id":"T1552.006","name":"Group Policy Preferences","url":"https://attack.mitre.org/techniques/T1552/006","tactics":["credential-access"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0381","stix_id":"x-mitre-detection-strategy--69b08c7a-c2ab-4e56-935d-ec28143372de","name":"Detect Access and Decryption of Group Policy Preference (GPP) Credentials in SYSVOL","url":"https://attack.mitre.org/detectionstrategies/DET0381","analytics":[{"id":"AN1075","stix_id":"x-mitre-analytic--e14e67af-6f6e-47d6-aa19-4012ea99284c","name":"Analytic 1075","description":"Correlates file enumeration of XML files in the SYSVOL share with suspicious process execution that decodes or reads encrypted credentials embedded in Group Policy Preference files (e.g., Get-GPPPassword.ps1, gpprefdecrypt.py, Metasploit). Detects abnormal access to \\DOMAIN\\SYSVOL combined with XML file parsing or decryption logic.","url":"https://attack.mitre.org/detectionstrategies/DET0381#AN1075","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=5145","data_component":"DC0102","data_component_name":"Network Share Access","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:PowerShell","channel":"Scripts with references to XML parsing, AES decryption, or gpprefdecrypt logic","data_component":"DC0029","data_component_name":"Script Execution","log_source_slug":"wineventlog-powershell"}],"mutable_elements":[{"field":"UserContext","description":"Tune to exclude authorized admin users or domain controllers accessing SYSVOL"},{"field":"TimeWindow","description":"Adjust for correlation timing between file access and script execution"},{"field":"KnownToolsSignature","description":"Extend to include known GPP parsing tool names or script hashes"},{"field":"HostType","description":"Distinguish between expected access from DCs vs. lateral movement from workstations"}],"live":true,"detection_strategies":["DET0381"],"techniques":["T1552.006"]}],"live":true,"version":"1.0","techniques":["T1552.006"]}],"sigma_rules":[{"id":"05f3c945-dcc8-4393-9f3d-af65077a8f86","title":"Suspicious SYSVOL Domain Group Policy Access","author":"Markus Neis, Jonhnathan Ribeiro, oscd.community","status":"test","level":"medium","date":"2018-04-09","modified":"2022-01-07","description":"Detects Access to Domain Group Policies stored in SYSVOL","references":["https://adsecurity.org/?p=2288","https://www.hybrid-analysis.com/sample/f2943f5e45befa52fb12748ca7171d30096e1d4fc3c365561497c618341299d5?environmentId=100"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1552.006"],"path":"rules/windows/process_creation/proc_creation_win_susp_sysvol_access.yml","techniques":["T1552.006"],"cves":[]},{"id":"47e4bab7-c626-47dc-967b-255608c9a920","title":"Permission Misconfiguration Reconnaissance Via Findstr.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-08-12","modified":"2023-11-11","description":"Detects usage of findstr with the \"EVERYONE\" or \"BUILTIN\" keywords.\nThis was seen being used in combination with \"icacls\" and other utilities to spot misconfigured files or folders permissions.\n","references":["https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1552.006"],"path":"rules/windows/process_creation/proc_creation_win_findstr_recon_everyone.yml","techniques":["T1552.006"],"cves":[]},{"id":"8344c19f-a023-45ff-ad63-a01c5396aea0","title":"Access To Sysvol Policies Share By Uncommon Process","author":"frack113","status":"test","level":"medium","date":"2023-12-21","modified":null,"description":"Detects file access requests to the Windows Sysvol Policies Share by uncommon processes","references":["https://github.com/vletoux/pingcastle"],"logsource":{"product":"windows","category":"file_access"},"tags":["attack.credential-access","attack.t1552.006","detection.threat-hunting"],"path":"rules-threat-hunting/windows/file/file_access/file_access_win_susp_gpo_access_uncommon_process.yml","techniques":["T1552.006"],"cves":[]},{"id":"91a2c315-9ee6-4052-a853-6f6a8238f90d","title":"Findstr GPP Passwords","author":"frack113","status":"test","level":"high","date":"2021-12-27","modified":"2023-11-11","description":"Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This value can be decrypted with gpp-decrypt.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.006/T1552.006.md#atomic-test-1---gpp-passwords-findstr"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1552.006"],"path":"rules/windows/process_creation/proc_creation_win_findstr_gpp_passwords.yml","techniques":["T1552.006"],"cves":[]},{"id":"d51694fe-484a-46ac-92d6-969e76d60d10","title":"Access To Potentially Sensitive Sysvol Files By Uncommon Applications","author":"frack113","status":"test","level":"medium","date":"2023-12-21","modified":"2024-07-29","description":"Detects file access requests to potentially sensitive files hosted on the Windows Sysvol share.","references":["https://github.com/vletoux/pingcastle"],"logsource":{"product":"windows","category":"file_access"},"tags":["attack.credential-access","attack.t1552.006"],"path":"rules/windows/file/file_access/file_access_win_susp_gpo_files.yml","techniques":["T1552.006"],"cves":[]},{"id":"fe63010f-8823-4864-a96b-a7b4a0f7b929","title":"LSASS Process Reconnaissance Via Findstr.EXE","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-08-12","modified":"2024-06-04","description":"Detects findstring commands that include the keyword lsass, which indicates recon actviity for the LSASS process PID","references":["https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1552.006"],"path":"rules/windows/process_creation/proc_creation_win_findstr_lsass.yml","techniques":["T1552.006"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}