ATT&CKcon 7.0 registration is open! Join us October 27-28, 2026 in McLean, VA or virtually. Register in person or register virtually. See the FAQ for hotel and venue details.
Detection strategy for Group Policy Discovery on Windows
Technique Detected: Group Policy Discovery | T1615
ID: DET0055
Domains: Enterprise
Analytics: AN0152
Version: 1.0
Created: 21 October 2025
Last Modified: 12 May 2026
Analytics
AN0152
Detection of adversary attempts to enumerate Group Policy settings through suspicious command execution (gpresult), PowerShell enumeration (Get-DomainGPO, Get-DomainGPOLocalGroup), and abnormal LDAP queries targeting groupPolicyContainer objects. Defenders observe unusual process lineage, script execution, or LDAP filter activity against domain controllers.
Log Sources
| Data Component | Name | Channel |
|---|---|---|
| Active Directory Object Access (DC0071) | WinEventLog:Security | EventCode=4661 |
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 |
| Command Execution (DC0064) | WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 |
| Network Traffic Content (DC0085) | NSM:Flow | query: High-volume LDAP traffic with filters targeting groupPolicyContainer attributes |
Mutable Elements
| Field | Description |
|---|---|
| TimeWindow | Defines the correlation window to link suspicious PowerShell activity, gpresult execution, and LDAP enumeration. |
| UserContext | Identifies accounts expected to perform GPO enumeration (administrators vs. standard users). |
| CommandLinePatterns | Patterns for detecting suspicious gpresult or PowerShell cmdlets; tunable to reduce noise in environments where these tools are common. |
