Findstr GPP Passwords
This rule detects the use of `find.exe` or `findstr.exe` to search for the string 'cpassword' within XML files located in the SYSVOL share. This activity is indicative of an adversary attempting to locate encrypted Group Policy Preferences (GPP) passwords, which can then be decrypted to obtain credentials.
Sigma
