{"id":"T1615","name":"Group Policy Discovery","url":"https://attack.mitre.org/techniques/T1615","tactics":["discovery"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0055","stix_id":"x-mitre-detection-strategy--e5eff2eb-4a41-44d1-9c79-4977fb73f569","name":"Detection strategy for Group Policy Discovery on Windows","url":"https://attack.mitre.org/detectionstrategies/DET0055","analytics":[{"id":"AN0152","stix_id":"x-mitre-analytic--bf5772b8-86b4-4d73-bbff-6abb5da9edac","name":"Analytic 0152","description":"Detection of adversary attempts to enumerate Group Policy settings through suspicious command execution (gpresult), PowerShell enumeration (Get-DomainGPO, Get-DomainGPOLocalGroup), and abnormal LDAP queries targeting groupPolicyContainer objects. Defenders observe unusual process lineage, script execution, or LDAP filter activity against domain controllers.","url":"https://attack.mitre.org/detectionstrategies/DET0055#AN0152","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4661","data_component":"DC0071","data_component_name":"Active Directory Object Access","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"},{"name":"NSM:Flow","channel":"query: High-volume LDAP traffic with filters targeting groupPolicyContainer attributes","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"TimeWindow","description":"Defines the correlation window to link suspicious PowerShell activity, gpresult execution, and LDAP enumeration."},{"field":"UserContext","description":"Identifies accounts expected to perform GPO enumeration (administrators vs. standard users)."},{"field":"CommandLinePatterns","description":"Patterns for detecting suspicious gpresult or PowerShell cmdlets; tunable to reduce noise in environments where these tools are common."}],"live":true,"detection_strategies":["DET0055"],"techniques":["T1615"]}],"live":true,"version":"1.0","techniques":["T1615"]}],"sigma_rules":[{"id":"07aa184a-870d-413d-893a-157f317f6f58","title":"Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-02-08","modified":null,"description":"Detects execution of the built-in script located in \"C:\\Windows\\System32\\gatherNetworkInfo.vbs\". Which can be used to gather information about the target machine","references":["https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs","https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.execution","attack.t1615","attack.t1059.005"],"path":"rules/windows/process_creation/proc_creation_win_susp_gather_network_info_execution.yml","techniques":["T1615","T1059.005"],"cves":[]},{"id":"575dce0c-8139-4e30-9295-1ee75969f7fe","title":"Potential Reconnaissance Activity Via GatherNetworkInfo.VBS","author":"blueteamer8699","status":"test","level":"medium","date":"2022-01-03","modified":"2023-02-08","description":"Detects execution of the built-in script located in \"C:\\Windows\\System32\\gatherNetworkInfo.vbs\". Which can be used to gather information about the target machine","references":["https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs","https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.execution","attack.t1615","attack.t1059.005"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_gather_network_info.yml","techniques":["T1615","T1059.005"],"cves":[]},{"id":"c484e533-ee16-4a93-b6ac-f0ea4868b2f1","title":"HackTool - SharpUp PrivEsc Tool Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2022-08-20","modified":"2023-02-13","description":"Detects the use of SharpUp, a tool for local privilege escalation","references":["https://github.com/GhostPack/SharpUp"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.privilege-escalation","attack.discovery","attack.execution","attack.stealth","attack.t1615","attack.t1569.002","attack.t1574.005"],"path":"rules/windows/process_creation/proc_creation_win_hktl_sharpup.yml","techniques":["T1615","T1569.002","T1574.005"],"cves":[]},{"id":"e56d3073-83ff-4021-90fe-c658e0709e72","title":"Gpresult Display Group Policy Information","author":"frack113","status":"test","level":"medium","date":"2022-05-01","modified":null,"description":"Detects cases in which a user uses the built-in Windows utility gpresult to display the Resultant Set of Policy (RSoP) information","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1615/T1615.md","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult","https://unit42.paloaltonetworks.com/emissary-trojan-changelog-did-operation-lotus-blossom-cause-it-to-evolve/","https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1615"],"path":"rules/windows/process_creation/proc_creation_win_gpresult_execution.yml","techniques":["T1615"],"cves":[]},{"id":"eb2fd349-ec67-4caa-9143-d79c7fb34441","title":"Suspicious GPO Discovery With Get-GPO","author":"frack113","status":"test","level":"low","date":"2022-06-04","modified":null,"description":"Detect use of Get-GPO to get one GPO or all the GPOs in a domain.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1615/T1615.md","https://learn.microsoft.com/en-us/powershell/module/grouppolicy/get-gpo?view=windowsserver2022-ps"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.discovery","attack.t1615"],"path":"rules/windows/powershell/powershell_script/posh_ps_susp_get_gpo.yml","techniques":["T1615"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}