Group Policy Discovery `T1615`

Tactic: Discovery

Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment. Group Policy allows for centralized management of user and computer settings in Active Directory (AD). Group policy objects (GPOs) are containers for group policy settings made up of files stored within a predictable network path `\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\`.

Events covered

3 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Security-Auditing	Event ID 4688	A new process has been created.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).

Authoring guide

These 11 rules share fields, values, and exclusions.

Fields filtered most (16 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`CommandLine`	6	`contains` 5, `is_not_null` 1	`gathernetworkinfo.vbs`, `-encodedcommand`, `/v`, `/z`, `cachedgpppassword`
`Image`	4	`ends_with` 4	`\cscript.exe`, `\wscript.exe`, `\gpresult.exe`, `\sharpup.exe`
`ScriptBlockText`	3	`in` 2, `contains` 1, `eq` 1	`get-clipboardtext`, `returnhotfixid`, `start-aclcheck`, `.getgporeport()`, `::getipglobalproperties()`
`EventID`	2	`eq` 2	`4104`, `4688`
`OriginalFileName`	2	`eq` 2	`cscript.exe`, `gprslt.exe`, `wscript.exe`
`event.type`	2	`eq` 2	`start`
`host.os.type`	2	`eq` 2
`process_name`	2	`eq` 2	`arp.exe`, `dsget.exe`, `dsquery.exe`, `gpresult.exe`
`Description`	1	`eq` 1	`sharpup`
`EfectiveCommand`	1	`regex_match` 1	`regexEmpire`
`EventData`	1	`contains` 1	`-encodedcommand`, `powershell.exe`, `powershell_ise.exe`
`event.category`	1	`eq` 1	`process`
`parent_process_name`	1	`eq` 1	`wmiprvse.exe`
`process.Ext.api.name`	1	`eq` 1	`ldap_search`
`process.Ext.api.parameters.search_filter`	1	`eq` 1	`(objectguid=?)`, `objectguid=?`

Top indicator values (176 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`CommandLine`	`contains`	`gathernetworkinfo.vbs` sigmaPotential Reconnaissance Activity Via GatherNetworkInfo.VBS sigmaSuspicious Reconnaissance Activity Via GatherNetworkInfo.VBS	2	2
`CommandLine`	`contains`	`-encodedcommand` kustoPowershell Empire Cmdlets Executed in Command Line	1	4
`CommandLine`	`contains`	`/v` sigmaGpresult Display Group Policy Information	1	5
`CommandLine`	`contains`	`/z` sigmaGpresult Display Group Policy Information	1
`CommandLine`	`contains`	`cachedgpppassword` sigmaHackTool - SharpUp PrivEsc Tool Execution	1
`CommandLine`	`contains`	`domaingpppassword` sigmaHackTool - SharpUp PrivEsc Tool Execution	1
`CommandLine`	`contains`	`hijackablepaths` sigmaHackTool - SharpUp PrivEsc Tool Execution	1
`CommandLine`	`contains`	`modifiablescheduledtask` sigmaHackTool - SharpUp PrivEsc Tool Execution	1
`CommandLine`	`contains`	`modifiableservicebinaries` sigmaHackTool - SharpUp PrivEsc Tool Execution	1
`CommandLine`	`contains`	`processdllhijack` sigmaHackTool - SharpUp PrivEsc Tool Execution	1
`CommandLine`	`contains`	`unquotedservicepath` sigmaHackTool - SharpUp PrivEsc Tool Execution	1
`Image`	`ends_with`	`\cscript.exe` sigmaPotential Reconnaissance Activity Via GatherNetworkInfo.VBS sigmaSuspicious Reconnaissance Activity Via GatherNetworkInfo.VBS	2	72
`Image`	`ends_with`	`\wscript.exe` sigmaPotential Reconnaissance Activity Via GatherNetworkInfo.VBS sigmaSuspicious Reconnaissance Activity Via GatherNetworkInfo.VBS	2	74
`Image`	`ends_with`	`\gpresult.exe` sigmaGpresult Display Group Policy Information	1
`Image`	`ends_with`	`\sharpup.exe` sigmaHackTool - SharpUp PrivEsc Tool Execution	1
`event.type`	`eq`	`start` elasticEnumeration Command Spawned via WMIPrvSE elasticGroup Policy Discovery via Microsoft GPResult Utility	2	1078
`process_name`	`eq`	`gpresult.exe` elasticEnumeration Command Spawned via WMIPrvSE elasticGroup Policy Discovery via Microsoft GPResult Utility	2	7
`Description`	`eq`	`sharpup` sigmaHackTool - SharpUp PrivEsc Tool Execution	1
`EfectiveCommand`	`regex_match`	`regexEmpire` kustoPowershell Empire Cmdlets Executed in Command Line	1
`EventData`	`contains`	`-encodedcommand` kustoPowershell Empire Cmdlets Executed in Command Line	1
`EventData`	`contains`	`powershell.exe` kustoPowershell Empire Cmdlets Executed in Command Line	1
`EventData`	`contains`	`powershell_ise.exe` kustoPowershell Empire Cmdlets Executed in Command Line	1
`EventData`	`contains`	`pwsh.exe` kustoPowershell Empire Cmdlets Executed in Command Line	1
`EventID`	`eq`	`4104` splunkWindows WinPEAS PowerShell Script Execution	1	269
`EventID`	`eq`	`4688` kustoPowershell Empire Cmdlets Executed in Command Line	1	317
`OriginalFileName`	`eq`	`cscript.exe` sigmaPotential Reconnaissance Activity Via GatherNetworkInfo.VBS	1	32
`OriginalFileName`	`eq`	`gprslt.exe` elasticGroup Policy Discovery via Microsoft GPResult Utility	1
`OriginalFileName`	`eq`	`wscript.exe` sigmaPotential Reconnaissance Activity Via GatherNetworkInfo.VBS	1	38
`ScriptBlockText`	`contains`	`get-gpo` sigmaSuspicious GPO Discovery With Get-GPO	1
`ScriptBlockText`	`eq`	`.getgporeport()` elasticDeprecated - PowerShell Script with Discovery Capabilities	1

Exclusions (21 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`EventData`	`contains`	`gc_service.exe` kustoPowershell Empire Cmdlets Executed in Command Line	1
`EventData`	`contains`	`gc_worker.exe` kustoPowershell Empire Cmdlets Executed in Command Line	1
`Image`	`ends_with`	`\cscript.exe` sigmaSuspicious Reconnaissance Activity Via GatherNetworkInfo.VBS	1
`Image`	`ends_with`	`\wscript.exe` sigmaSuspicious Reconnaissance Activity Via GatherNetworkInfo.VBS	1
`ParentImage`	`contains`	`gc_service.exe` kustoPowershell Empire Cmdlets Executed in Command Line	1
`ParentImage`	`contains`	`gc_worker.exe` kustoPowershell Empire Cmdlets Executed in Command Line	1
`ScriptBlockText`	`eq`	`__cmdletization_bindcommonparameters` elasticDeprecated - PowerShell Script with Discovery Capabilities	1
`ScriptBlockText`	`eq`	`cdxml-help.xml` elasticDeprecated - PowerShell Script with Discovery Capabilities	1
`ScriptBlockText`	`eq`	`cmdletization` elasticDeprecated - PowerShell Script with Discovery Capabilities	1
`ScriptBlockText`	`eq`	`cmdletstoexport=@("add-content",` elasticDeprecated - PowerShell Script with Discovery Capabilities	1
`ScriptBlockText`	`eq`	`microsoft.powershell.cmdletization.cim.cimcmdletadapter` elasticDeprecated - PowerShell Script with Discovery Capabilities	1
`ScriptBlockText`	`eq`	`microsoft.powershell.core\export-modulemember` elasticDeprecated - PowerShell Script with Discovery Capabilities	1
`process.args`	`eq`	`demand` elasticEnumeration Command Spawned via WMIPrvSE	1
`process.args`	`eq`	`disabled` elasticEnumeration Command Spawned via WMIPrvSE	1
`process.args`	`eq`	`remoteregistry` elasticEnumeration Command Spawned via WMIPrvSE	1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Windows

Domain: Endpoint

Sigma 5 rules

Elastic 4 rules

Splunk 1 rule

Windows WinPEAS PowerShell Script Execution

Kusto 1 rule

Powershell Empire Cmdlets Executed in Command Line

Group Policy Discovery T1615