Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
31 detections
Filters
Last updated
All Time
Detection languages
18
6
2
2
2
Contributors
10
8
3
3
2
Categories
15
14
10
5
2
Platforms
29
2
2
Products / Services
6
6
4
3
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
IDS Classtypes
2
IDS Protocols
2
Detects unauthorized access or decryption attempts related to Group Policy Preferences (GPP) files stored in SYSVOL. Adversaries often target these XML files to extract embedded 'cpassword' attributes, which can be decrypted using publicly known keys to obtain plain-text administrative credentials.
Detects unauthorized access or decryption attempts related to Group Policy Preferences (GPP) files stored in the SYSVOL share. Attackers often target these files to retrieve credentials stored in the 'cpassword' attribute, which can be decrypted using publicly known keys.
SYSVOL / NETLOGON Enumeration
Cortex XDR
Every authenticated principal in the domain can read SYSVOL, and SYSVOL routinely stores logon scripts, scheduled-task XML, and GPP files that contain plaintext or reversibly-encrypted credentials. Adversaries recursively enumerate SYSVOL to harvest these — either grepping file contents (Select-String 'password') or matching file names (dir *password*). This rule detects the read-access footprint of that enumeration on the DC itself, independent of the tool or command line used, by counting distinct SYSVOL paths accessed by a single non-machine account in a short window. Default threshold is 100, change to a high volume for your environment
SYSVOL / NETLOGON Enumeration
Cortex XDR
Every authenticated principal in the domain can read SYSVOL, and SYSVOL routinely stores logon scripts, scheduled-task XML, and GPP files that contain plaintext or reversibly-encrypted credentials. Adversaries recursively enumerate SYSVOL to harvest these — either grepping file contents (Select-String 'password') or matching file names (dir *password*). This rule detects the read-access footprint of that enumeration on the DC itself, independent of the tool or command line used, by counting distinct SYSVOL paths accessed by a single non-machine account in a short window. Default threshold is 100, change to a high volume for your environment
Detects read access to the Groups.xml file located in the SYSVOL share. This file is often used by Group Policy Preferences (GPP) to store credentials for local administrator accounts, which can be retrieved and decrypted by unauthorized users.
Detects access to Group Policy Preferences files with encrypted passwords
Detects attempts to read the 'Groups.xml' file within the SYSVOL share. This file can contain sensitive credential information if Group Policy Preferences were used to deploy local user accounts or services, as the passwords might be stored in a decryptable format. Adversaries often target this file to extract credentials.
This rule detects attempts to read the 'cpassword' field from Group Policy Preferences XML files over SMB. The 'cpassword' field was historically used to store encrypted passwords, which could be easily decrypted, leading to credential exposure. Detection of this string in SMB traffic indicates an attempt to access or exfiltrate these sensitive credentials.
This rule detects attempts to harvest Group Policy Preferences (GPP) credentials from the SYSVOL share over SMB. It specifically looks for network traffic on port 445 (SMB) containing the strings "SYSVOL" and "Groups.xml" in a case-insensitive manner, indicating a potential attempt to access the file where GPP credentials might be stored.
Detects execution of suspicious tools or commands that may indicate credential or secret discovery. Generic detection for processes attempting to enumerate credentials, secrets, or sensitive information across files, repositories, or environments.
Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This value can be decrypted with gpp-decrypt.
Detects findstring commands that include the keyword lsass, which indicates recon actviity for the LSASS process PID
Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords.
This was seen being used in combination with "icacls" and other utilities to spot misconfigured files or folders permissions.
This was seen being used in combination with "icacls" and other utilities to spot misconfigured files or folders permissions.
The analytic detects the execution of the Get-GPPPassword or Get-CachedGPPPassword PowerShell cmdlets, which are used to search for unsecured credentials in Group Policy Preferences (GPP). This detection leverages PowerShell Script Block Logging to identify specific script block text associated with these cmdlets. Monitoring this activity is crucial as it can indicate an attempt to retrieve and decrypt stored credentials from SYSVOL, potentially leading to unauthorized access. If confirmed malicious, this activity could allow an attacker to escalate privileges or move laterally within the network by exploiting exposed credentials.
Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This value can be decrypted with gpp-decrypt.
Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords.
This was seen being used in combination with "icacls" and other utilities to spot misconfigured files or folders permissions.
This was seen being used in combination with "icacls" and other utilities to spot misconfigured files or folders permissions.
Detects findstring commands that include the keyword lsass, which indicates recon actviity for the LSASS process PID
Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This value can be decrypted with gpp-decrypt.
Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords.
This was seen being used in combination with "icacls" and other utilities to spot misconfigured files or folders permissions.
This was seen being used in combination with "icacls" and other utilities to spot misconfigured files or folders permissions.
Author: alex verboon @alexverboon.
Blogpost: https://www.verboon.info/2020/09/hunting-for-local-group-membership-changes.
Blogpost: https://www.verboon.info/2020/09/hunting-for-local-group-membership-changes.
Detects Access to Domain Group Policies stored in SYSVOL
Page 1 of 2