Techniques › T1552 › T1552.006

T1552.006 Group Policy Preferences

credential access — Windows · attack.mitre.org · JSON

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

• DET0381 Detect Access and Decryption of Group Policy Preference (GPP) Credentials in SYSVOL v1.0
  AN1075 Windows

  Correlates file enumeration of XML files in the SYSVOL share with suspicious process execution that decodes or reads encrypted credentials embedded in Group Policy Preference files (e.g., Get-GPPPassword.ps1, gpprefdecrypt.py, Metasploit). Detects abnormal access to \DOMAIN\SYSVOL combined with XML file parsing or decryption logic.

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Security EventCode=5145 → DC0102 Network Share Access

  WinEventLog:PowerShell Scripts with references to XML parsing, AES decryption, or gpprefdecrypt logic → DC0029 Script Execution

  Tunable: UserContext TimeWindow KnownToolsSignature HostType

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1552.006

Rules tagged at the parent level (attack.t1552) 13

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.