T1615 Group Policy Discovery
Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment. Group Policy allows for centralized management of user and computer settings in Active Directory (AD). Group policy objects (GPOs) are containers…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- HackTool - SharpUp PrivEsc Tool Executioncriticaltest · windows
- Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBShightest · windows
- Gpresult Display Group Policy Informationmediumtest · windows
- Potential Reconnaissance Activity Via GatherNetworkInfo.VBSmediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.