T1552.006 — Group Policy Preferences

Tactic: Credential Access · Platforms: Windows

Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts. These group policies are stored in SYSVOL on a domain…

Sub-technique of Unsecured Credentials (T1552).

Sigma detection rules (1)

T1552.006 Unsecured Credentials: Group Policy Preferences

title: "T1552.006 Unsecured Credentials: Group Policy Preferences"
id: e8117de7-e7c5-4623-a111-14410e015ac2
description: 'Detect Access and Decryption of GPP Credentials in SYSVOL, retargeted to process command lines referencing cpassword or known GPP XML filenames alongside a SYSVOL path. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: UserContext, TimeWindow, KnownToolsSignature, HostType.'
references:
  - https://attack.mitre.org/techniques/T1552/006
author: Shahrukh Khan
date: 2026-02-04
license: MIT
tags:
  - attack.credential-access
  - attack.t1552.006

logsource:
  category: process_creation
  product: windows

detection:
  selection_cpassword:
    CommandLine|contains: 'cpassword'
  selection_sysvol:
    CommandLine|contains: 'SYSVOL'
  selection_gpp_filenames:
    CommandLine|contains:
      - 'Groups.xml'
      - 'Services.xml'
      - 'ScheduledTasks.xml'
      - 'Printers.xml'
      - 'Drives.xml'
      - 'DataSources.xml'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: (selection_cpassword or (selection_sysvol and selection_gpp_filenames)) and not filter_system_account

falsepositives:
  - Legitimate GPO administration/troubleshooting scripts.

level: medium

Related sub-techniques

Explore