Group Policy Discovery via Command Line and Network Activity
This rule detects attempts to discover Group Policy settings on a Windows system. It identifies the execution of common command-line interpreters (cmd.exe, powershell.exe, wmic.exe, rundll32.exe) followed by specific commands or PowerShell cmdlets used for GPO enumeration. This includes native Windows commands like 'gpresult' and 'secedit', registry queries for policy settings, and PowerShell cmdlets such as 'Get-GPO' and 'Get-GPResultantSetOfPolicy'. Additionally, it looks for LDAP-related commands or patterns ('ldapsearch', 'groupPolicyContainer') that might indicate GPO discovery via directory services. The rule also correlates these process events with network connections to SYSVOL shares or LDAP ports (389, 636) to further confirm GPO-related activity.
Microsoft Sentinel (KQL)
