Detect Group Policy Discovery in Splunk
This detection identifies adversary attempts to enumerate Group Policy Objects (GPOs) and Group Policy settings within an Active Directory environment. Attackers use tools such as gpresult.exe, PowerShell cmdlets (Get-DomainGPO, Get-DomainGPOLocalGroup, Get-GPO), and frameworks like PowerView and BloodHound to discover GPO configurations that reveal privilege escalation paths, security control gaps, and domain trust relationships. Detected activity includes direct invocation of gpresult.exe outside of normal administrative contexts, PowerShell-based GPO enumeration via PowerView or RSAT cmdlets, and LDAP queries targeting GPO-related LDAP attributes. Correlating these patterns with post-discovery activity such as lateral movement or GPO modification attempts allows analysts to identify reconnaissance phases of domain-targeted attacks.
MITRE ATT&CK
- Tactic
- Discovery
- Technique
- T1615 Group Policy Discovery
- Canonical reference
- https://attack.mitre.org/techniques/T1615/
SPL Detection Query
index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval process_lower=lower(Image)
| eval cmdline_lower=lower(CommandLine)
| eval parent_lower=lower(ParentImage)
| where (
(
match(process_lower, "gpresult\.exe")
AND NOT match(parent_lower, "(?i)(mmc|gpedit|gpmc|msiexec|ccmexec|sccmexec)")
AND NOT match(User, "(?i)\\$$")
)
OR (
match(process_lower, "(powershell|pwsh)\.exe")
AND match(cmdline_lower, "(get-domaingpo|get-netgpo|get-gpo|get-gpresultantsetofpolicy|get-gporeport|find-gpolocation|find-gpocomputeradmin|domaingpolocalgroup|domaingpouserlocal)")
)
OR (
match(process_lower, "wmic\.exe")
AND match(cmdline_lower, "(gpo|grouppolicy)")
)
)
| eval detection_type=case(
match(process_lower, "gpresult\.exe"), "gpresult_execution",
match(process_lower, "(powershell|pwsh)\.exe"), "powershell_gpo_enumeration",
match(process_lower, "wmic\.exe"), "wmic_gpo_query",
true(), "unknown"
)
| table _time, Computer, User, Image, CommandLine, ParentImage, ParentCommandLine, detection_type
| sort - _timeDetects Group Policy Discovery via Sysmon process creation events (EventCode=1). Identifies gpresult.exe executions not initiated by legitimate admin tools, PowerShell commands using PowerView and RSAT GPO enumeration functions, and WMIC GPO queries. Machine accounts are excluded via the trailing $ pattern check on the User field.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Administrators using gpresult.exe from command prompt or PowerShell sessions for troubleshooting GPO application failures
- Security baselines and audit scripts leveraging Get-GPO or Get-GPResultantSetOfPolicy via scheduled tasks running under service accounts
- Group Policy management consoles (GPMC, RSAT) that spawn gpresult.exe as a subprocess during GPO modeling or reporting operations
- Red team assessments and authorized penetration tests using PowerView or BloodHound for AD enumeration
- IT automation platforms (Ansible, Chef, Puppet) using PowerShell to validate GPO application state on managed endpoints
Other platforms for T1615
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1GPO Enumeration via gpresult.exe
Expected signal: Sysmon EventCode=1: Image=gpresult.exe with CommandLine containing /z and /scope. Security EventID=4688 if process creation auditing enabled with command line logging. File creation event for C:\Temp\gpo_computer.txt (Sysmon EventCode=11).
- Test 2GPO Enumeration via PowerView Get-DomainGPO
Expected signal: Sysmon EventCode=1: powershell.exe with CommandLine containing Get-DomainGPO. PowerShell Script Block Logging (EventID 4104) capturing the full IEX expression and Get-DomainGPO function body. Sysmon EventCode=3 for LDAP connections to domain controllers (port 389) from powershell.exe.
- Test 3GPO Enumeration via RSAT Get-GPO PowerShell Cmdlet
Expected signal: Sysmon EventCode=1: powershell.exe with CommandLine containing 'Get-GPO' and 'Get-GPResultantSetOfPolicy'. PowerShell EventID 4103/4104 capturing module import of GroupPolicy and cmdlet invocations. Sysmon EventCode=11 for HTML report file creation at C:\Temp\rsop_report.html. LDAP traffic to domain controllers for GPO object queries.
References (7)
- https://attack.mitre.org/techniques/T1615/
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult
- https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1
- https://bloodhound.readthedocs.io/en/latest/
- https://adsecurity.org/?p=2716
- https://www.microsoft.com/en-us/security/blog/2022/10/05/detecting-and-preventing-privilege-escalation-attacks-leveraging-kerberos-relaying-rbcd/
- https://www.eset.com/int/about/newsroom/press-releases/research/eset-research-uncovers-lunar-toolset-used-by-turla-apt-group/
Unlock Pro Content
Get the full detection package for T1615 including response playbook, investigation guide, and atomic red team tests.