Group Policy Discovery

let SuspiciousGPOPSFunctions = dynamic([
    "Get-DomainGPO", "Get-DomainGPOLocalGroup", "Get-DomainGPOComputerLocalGroupMapping",
    "Get-DomainGPOUserLocalGroupMapping", "Get-NetGPO", "Get-GPO",
    "Get-GPResultantSetOfPolicy", "Get-GPOReport", "Find-GPOLocation",
    "Find-GPOComputerAdmin"
]);
let LegitParents = dynamic(["mmc.exe", "gpedit.msc", "gpmc.msc", "msiexec.exe", "sccmexec.exe", "ccmexec.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(1d)
| where (
    // Direct gpresult enumeration outside standard admin parent processes
    (FileName =~ "gpresult.exe"
        and not(InitiatingProcessFileName has_any (LegitParents))
        and AccountName !endswith "$"
    )
    // PowerShell GPO enumeration via PowerView, Empire, or RSAT
    or (FileName in~ ("powershell.exe", "pwsh.exe")
        and ProcessCommandLine has_any (SuspiciousGPOPSFunctions)
    )
    // WMIC-based GPO queries
    or (FileName =~ "wmic.exe"
        and ProcessCommandLine has_any ("gpo", "grouppolicy")
    )
    // net.exe querying GPO-related groups
    or (FileName =~ "net.exe"
        and ProcessCommandLine matches regex @"(?i)(group\s*policy|gpo)"
    )
)
| extend AccountUpn = strcat(AccountDomain, "\\", AccountName)
| project
    TimeGenerated,
    DeviceName,
    AccountUpn,
    AccountName,
    AccountDomain,
    FileName,
    ProcessCommandLine,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine,
    InitiatingProcessParentFileName,
    FolderPath
| order by TimeGenerated desc

index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval process_lower=lower(Image)
| eval cmdline_lower=lower(CommandLine)
| eval parent_lower=lower(ParentImage)
| where (
    (
        match(process_lower, "gpresult\.exe")
        AND NOT match(parent_lower, "(?i)(mmc|gpedit|gpmc|msiexec|ccmexec|sccmexec)")
        AND NOT match(User, "(?i)\\$$")
    )
    OR (
        match(process_lower, "(powershell|pwsh)\.exe")
        AND match(cmdline_lower, "(get-domaingpo|get-netgpo|get-gpo|get-gpresultantsetofpolicy|get-gporeport|find-gpolocation|find-gpocomputeradmin|domaingpolocalgroup|domaingpouserlocal)")
    )
    OR (
        match(process_lower, "wmic\.exe")
        AND match(cmdline_lower, "(gpo|grouppolicy)")
    )
)
| eval detection_type=case(
    match(process_lower, "gpresult\.exe"), "gpresult_execution",
    match(process_lower, "(powershell|pwsh)\.exe"), "powershell_gpo_enumeration",
    match(process_lower, "wmic\.exe"), "wmic_gpo_query",
    true(), "unknown"
)
| table _time, Computer, User, Image, CommandLine, ParentImage, ParentCommandLine, detection_type
| sort - _time

process where process.name : ("gpresult.exe", "powershell.exe") and (process.args : ("/r", "/v", "/h", "/z", "/scope", "computer", "user") or process.command_line : ("*Get-GPO*", "*Get-GPOReport*", "*Get-GPPermissions*")) and process.parent.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe")

SELECT username as "Username", "UTF8(payload)" as "CommandLine", sourceip as "SourceIP", devicetime as "EventTime", CASE WHEN "CommandLine" ILIKE '%gpresult%' AND ("CommandLine" ILIKE '%/r%' OR "CommandLine" ILIKE '%/v%') THEN 65 WHEN "CommandLine" ILIKE '%Get-GPO%' OR "CommandLine" ILIKE '%Get-GPOReport%' THEN 70 ELSE 45 END as "RiskScore" FROM events WHERE eventid = 4688 AND ("CommandLine" ILIKE '%gpresult%' OR "CommandLine" ILIKE '%Get-GPO%' OR "CommandLine" ILIKE '%GroupPolicy%') ORDER BY "RiskScore" DESC LAST 24 HOURS

_sourceCategory=endpoint/windows | json auto | where process_name = "gpresult.exe" or (process_name = "powershell.exe" and (command_line matches "*Get-GPO*" or command_line matches "*Get-GPOReport*")) | if(matches(parent_process, "*powershell*") or matches(parent_process, "*cmd*"), "Medium", "Low") as RiskLevel | stats count by user_name, process_name, command_line, host_name, RiskLevel | sort by count desc

rule detect_group_policy_discovery {
  meta:
    author = "Argus"
    description = "Detects Group Policy enumeration activities"
    severity = "MEDIUM"
    technique = "T1615"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      re.regex($e.target.process.file.full_path, `gpresult\.exe`) nocase or
      re.regex($e.target.process.command_line, `Get-GPO|Get-GPOReport|Get-GPPermission|gpresult`) nocase
    )
    not $e.principal.user.windows_sid = "S-1-5-18"
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ImageFileName = /gpresult\.exe/i OR (ImageFileName = /powershell/i AND CommandHistory = /Get-GPO|Get-GPOReport|Get-GPPermission/i)
| case {
    CommandHistory = /Get-GPOReport/i | DiscoveryType := "GPO Full Report";
    CommandHistory = /Get-GPO|Get-GPPermission/i | DiscoveryType := "GPO Enumeration";
    ImageFileName = /gpresult/i | DiscoveryType := "GPResult Query";
    * | DiscoveryType := "GP Discovery"
  }
| table([@timestamp, UserName, ComputerName, ImageFileName, CommandHistory, DiscoveryType])