Findstr GPP Passwords

SigmaHQ Detections@sigmaHQ

•updated Nov 26, 2025•0•0•1

Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This value can be decrypted with gpp-decrypt.