Detect Group Policy Preferences in Microsoft Sentinel
Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). GPP allows administrators to set local accounts and passwords in Active Directory environments. These credentials are stored in SYSVOL as XML files (Groups.xml, ScheduledTasks.xml, Printers.xml, etc.) with passwords encrypted using AES-256. However, Microsoft publicly released the AES encryption key in 2012 (MS14-025), making any stored cpassword trivially decryptable. Domain users have read access to SYSVOL. Tools include PowerSploit's Get-GPPPassword, Metasploit's post/windows/gather/credentials/gpp module, and gpprefdecrypt.py. APT33, Wizard Spider, and SILENTTRINITY have all used this technique.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1552 Unsecured Credentials
- Sub-technique
- T1552.006 Group Policy Preferences
- Canonical reference
- https://attack.mitre.org/techniques/T1552/006/
KQL Detection Query
// Detect GPP credential harvesting via SYSVOL access and decryption tools
DeviceProcessEvents
| where Timestamp > ago(24h)
// Pattern 1: PowerSploit GPP modules
| where ProcessCommandLine has_any (
"Get-GPPPassword", "Get-CachedGPPPassword", "Find-GPOPassword",
"Get-GPPAutologon", "Get-SiteListPassword"
)
| extend Pattern = "PowerSploit_GPP"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, Pattern
| union (
// Pattern 2: Search for cpassword string in SYSVOL XML files
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has "cpassword"
or (ProcessCommandLine has "SYSVOL" and ProcessCommandLine has ".xml")
| extend Pattern = "GPP_CpasswordSearch"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, Pattern
)
| union (
// Pattern 3: Direct SYSVOL XML file access
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileRead" or ActionType == "FileAccessed"
| where (FolderPath has "SYSVOL" or FolderPath has "Policies")
and (FileName has_any ("Groups.xml", "ScheduledTasks.xml", "DataSources.xml",
"Printers.xml", "Services.xml"))
| where InitiatingProcessFileName !in~ ("System", "svchost.exe")
| extend Pattern = "GPP_XMLAccess"
| project Timestamp, DeviceName, InitiatingProcessAccountName, FolderPath, FileName,
InitiatingProcessFileName, Pattern
)
| sort by Timestamp descDetects GPP credential harvesting via three patterns: PowerSploit GPP modules (Get-GPPPassword, Get-CachedGPPPassword, Find-GPOPassword) in PowerShell command lines; searches for 'cpassword' string or SYSVOL XML files; and direct file access to known GPP credential XML files (Groups.xml, ScheduledTasks.xml, etc.) from non-system processes.
Data Sources
Required Tables
False Positives & Tuning
- Group Policy administrators legitimately accessing and reviewing GPP XML files for configuration management
- GPMC (Group Policy Management Console) reading GPP XML files during policy editing and backup operations
- Active Directory backup tools that read the entire SYSVOL share including GPP XML files
- Authorized security assessments explicitly checking for cpassword fields in GPP XML files
- Domain controller replication processes synchronizing SYSVOL content between DCs
Other platforms for T1552.006
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Search SYSVOL for GPP Credentials with findstr
Expected signal: Sysmon Event ID 1: findstr.exe with 'cpassword' and SYSVOL. Sysmon Event ID 3: outbound SMB connection to DC (port 445). Security Event ID 5140 on DC: share access to \\*\SYSVOL.
- Test 2PowerSploit Get-GPPPassword
Expected signal: Sysmon Event ID 1: powershell.exe with Get-GPPPassword and DownloadString. Sysmon Event ID 3: connection to SYSVOL on DC (port 445) AND outbound to GitHub for download. PowerShell ScriptBlock Log Event ID 4104 with Get-GPPPassword function.
- Test 3Enumerate GPP XML Files in SYSVOL
Expected signal: Sysmon Event ID 1: cmd.exe with 'dir /s' and SYSVOL. Sysmon Event ID 3: SMB connection to DC. Security Event ID 5140 on DC: SYSVOL share access.
- Test 4Decrypt GPP cpassword with Python
Expected signal: Sysmon Event ID 1: powershell.exe with AesManaged and cpassword in command line. PowerShell ScriptBlock Log Event ID 4104 showing the AES decryption logic.
References (7)
- https://attack.mitre.org/techniques/T1552/006/
- https://obscuresecurity.blogspot.com/2012/05/gpp-passwords-in-group-policy.html
- https://learn.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-025
- https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-GPPPassword.ps1
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1552.006/T1552.006.md
- https://www.mandiant.com/resources/blog/fin12-ransomware-intrusion-actor-partnering-trickbot
- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory
Unlock Pro Content
Get the full detection package for T1552.006 including response playbook, investigation guide, and atomic red team tests.