TurlaG0010 ↗
Surveys a system upon check-in to discover Group Policy details using the gpresult command.1
tfMITRE ATT&CK technique
Group Policy Discovery T1615
- Tactic
- Discovery
- Platform
- Windows
- Version
- 1.1
- Created
- 06 August 2021
- Last modified
- 24 October 2025
- Contributors
- Ted Samuels, Rapid7; Jonhnathan Ribeiro, 3CORESec, @_w0rk3r
Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment. Group Policy allows for centralized management of user and computer settings in Active Directory (AD). Group policy objects (GPOs) are containers for group policy settings made up of files stored within a predictable network path \<DOMAIN>\SYSVOL\<DOMAIN>\Policies\.[1][2]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.5
Tools & malware66th pct
Tools & malware66th percentile · 66% of ATT&CK techniques have this many tools implementing them or fewer.6
Detection rules67th pct
Detection rules67th percentile · 67% of ATT&CK techniques have this many detection rules written or fewer.Group Policy Discovery MITRE reference T1615
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 1 groups for this technique
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Leviathan Australian IntrusionsC0049 ↗
Leviathan performed extensive Active Directory enumeration of victim environments during Leviathan Australian Intrusions.1
All 1 campaigns for this technique
5 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
DUSTTRAPS1159 ↗
Can identify victim environment Group Policy information.1
LunarWebS1141 ↗
Can capture information on group policy settings1
BloodHoundS0521 ↗
Has the ability to collect local admin information via GPO.1
EmpireS0363 ↗
Includes various modules for enumerating Group Policy.1
EmissaryS0082 ↗
Has the capability to execute gpresult.1
All 5 software entries for this technique
Offense vs defense T1615
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 5Splunk ESCU (cumulative) · 1
first rule: 2022 Q1 · 1 of 1 campaigns plottedGroup Policy Discovery detection strategy DET0055
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection strategy for Group Policy Discovery on Windows
1 platform
AN0152 · Windows
Detection of adversary attempts to enumerate Group Policy settings through suspicious command execution (gpresult), PowerShell enumeration (Get-DomainGPO, Get-DomainGPOLocalGroup), and abnormal LDAP queries targeting groupPolicyContainer objects. Defenders observe unusual process lineage, script execution, or LDAP filter activity against domain controllers.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Command ExecutionDC0064 | WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 |
| Active Directory Object AccessDC0071 | WinEventLog:Security | EventCode=4661 |
| Network Traffic ContentDC0085 | NSM:Flow | query: High-volume LDAP traffic with filters targeting groupPolicyContainer attributes |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Defines the correlation window to link suspicious PowerShell activity, gpresult execution, and LDAP enumeration. |
| UserContext | Identifies accounts expected to perform GPO enumeration (administrators vs. standard users). |
| CommandLinePatterns | Patterns for detecting suspicious gpresult or PowerShell cmdlets; tunable to reduce noise in environments where these tools are common. |
Tests5ExecutorsPowerShell 4 · cmd 1Need elevation2 of 5Have prerequisites1Have cleanup1Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition