Detect Group Policy Preferences in Splunk
Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). GPP allows administrators to set local accounts and passwords in Active Directory environments. These credentials are stored in SYSVOL as XML files (Groups.xml, ScheduledTasks.xml, Printers.xml, etc.) with passwords encrypted using AES-256. However, Microsoft publicly released the AES encryption key in 2012 (MS14-025), making any stored cpassword trivially decryptable. Domain users have read access to SYSVOL. Tools include PowerSploit's Get-GPPPassword, Metasploit's post/windows/gather/credentials/gpp module, and gpprefdecrypt.py. APT33, Wizard Spider, and SILENTTRINITY have all used this technique.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1552 Unsecured Credentials
- Sub-technique
- T1552.006 Group Policy Preferences
- Canonical reference
- https://attack.mitre.org/techniques/T1552/006/
SPL Detection Query
index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="WinEventLog:Security")
(
EventCode=1
(CommandLine="*Get-GPPPassword*" OR CommandLine="*Get-CachedGPPPassword*" OR
CommandLine="*Find-GPOPassword*" OR CommandLine="*Get-GPPAutologon*" OR
CommandLine="*cpassword*" OR
(CommandLine="*SYSVOL*" AND CommandLine="*.xml*"))
| eval AlertType="GPP_CommandExec"
| table _time, host, User, Image, CommandLine, AlertType
)
OR
(
sourcetype="WinEventLog:Security" (EventCode=5140 OR EventCode=5145)
(Share_Name="\\\\*\\SYSVOL" OR Object_Name="*\\Policies\\*" OR
Object_Name="*Groups.xml*" OR Object_Name="*ScheduledTasks.xml*" OR
Object_Name="*DataSources.xml*" OR Object_Name="*Printers.xml*")
NOT Account_Name IN ("SYSTEM", "*$")
| eval AlertType="GPP_SYSVOLAccess"
| table _time, host, Account_Name, Client_Address, Share_Name, Object_Name, AlertType
)
OR
(
EventCode=1
(Image="*\\gpprefdecrypt*" OR CommandLine="*gpprefdecrypt*" OR CommandLine="*AES-256*SYSVOL*")
| eval AlertType="GPP_DecryptionTool"
| table _time, host, User, Image, CommandLine, AlertType
)
| sort - _timeDetects GPP credential harvesting using three Splunk searches: PowerSploit GPP modules in command lines (Get-GPPPassword, Find-GPOPassword), SYSVOL share access to GPP XML files via Windows Security Event 5140/5145 (requires Object Access auditing), and execution of gpprefdecrypt tool. The AlertType field identifies the specific detection category.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Group Policy administrators accessing GPP XML files for configuration management
- GPMC reading GPP XML files during policy editing
- Active Directory backup tools reading SYSVOL share
- Authorized security assessments checking for cpassword in GPP XML
- Domain controller replication synchronizing SYSVOL
Other platforms for T1552.006
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Search SYSVOL for GPP Credentials with findstr
Expected signal: Sysmon Event ID 1: findstr.exe with 'cpassword' and SYSVOL. Sysmon Event ID 3: outbound SMB connection to DC (port 445). Security Event ID 5140 on DC: share access to \\*\SYSVOL.
- Test 2PowerSploit Get-GPPPassword
Expected signal: Sysmon Event ID 1: powershell.exe with Get-GPPPassword and DownloadString. Sysmon Event ID 3: connection to SYSVOL on DC (port 445) AND outbound to GitHub for download. PowerShell ScriptBlock Log Event ID 4104 with Get-GPPPassword function.
- Test 3Enumerate GPP XML Files in SYSVOL
Expected signal: Sysmon Event ID 1: cmd.exe with 'dir /s' and SYSVOL. Sysmon Event ID 3: SMB connection to DC. Security Event ID 5140 on DC: SYSVOL share access.
- Test 4Decrypt GPP cpassword with Python
Expected signal: Sysmon Event ID 1: powershell.exe with AesManaged and cpassword in command line. PowerShell ScriptBlock Log Event ID 4104 showing the AES decryption logic.
References (7)
- https://attack.mitre.org/techniques/T1552/006/
- https://obscuresecurity.blogspot.com/2012/05/gpp-passwords-in-group-policy.html
- https://learn.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-025
- https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-GPPPassword.ps1
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1552.006/T1552.006.md
- https://www.mandiant.com/resources/blog/fin12-ransomware-intrusion-actor-partnering-trickbot
- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory
Unlock Pro Content
Get the full detection package for T1552.006 including response playbook, investigation guide, and atomic red team tests.