GPP Credentials Harvested from SYSVOL Share

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects attempts to harvest Group Policy Preferences (GPP) credentials from the SYSVOL share over SMB. It specifically looks for network traffic on port 445 (SMB) containing the strings "SYSVOL" and "Groups.xml" in a case-insensitive manner, indicating a potential attempt to access the file where GPP credentials might be stored.