Group Policy Preferences XML Password Field Read

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•6

This rule detects attempts to read the 'cpassword' field from Group Policy Preferences XML files over SMB. The 'cpassword' field was historically used to store encrypted passwords, which could be easily decrypted, leading to credential exposure. Detection of this string in SMB traffic indicates an attempt to access or exfiltrate these sensitive credentials.