t1615-group-policy-discovery

name	T1615_group-policy-discovery
description	Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that ca...
category	information-gathering
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1615","discovery","windows"]
technique_id	T1615
tactic	discovery
all_tactics	["discovery"]
platforms	["Windows"]
mitre_url	https://attack.mitre.org/techniques/T1615
tech_stack	["windows"]
cwe_ids	["CWE-200"]
chains_with	[]
prerequisites	[]
severity_boost	{}

T1615 Group Policy Discovery

High-Level Description

Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment. Group Policy allows for centralized management of user and computer settings in Active Directory (AD). Group policy objects (GPOs) are containers for group policy settings made up of files stored within a predictable network path \<DOMAIN>\SYSVOL\<DOMAIN>\Policies\.

Adversaries may use commands such as gpresult or various publicly available PowerShell functions, such as Get-DomainGPO and Get-DomainGPOLocalGroup, to gather information on Group Policy settings. Adversaries may use this information to shape follow-on behaviors, including determining potential attack paths within the target network as well as opportunities to manipulate Group Policy settings (i.e. Domain or Tenant Policy Modification) for their benefit.

Kill Chain Phase

• Discovery (TA0007)

Platforms: Windows

What to Check

• Identify if Group Policy Discovery technique is applicable to target environment
• Check Windows systems for indicators of Group Policy Discovery
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Display group policy information via gpresult

Uses the built-in Windows utility gpresult to display the Resultant Set of Policy (RSoP) information for a remote user and computer The /z parameter displays all available information about Group Policy. More parameters can be found in the linked Microsoft documentation https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult https://unit42.paloaltonetworks.com/emissary-trojan-changelog-did-operation-lotus-blossom-cause-it-to-evolve/ Turla has used the /z and /v parameters: https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf