T1615 — Group Policy Discovery

Tactic: Discovery · Platforms: Windows

Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment. Group Policy allows for centralized management…

Sigma detection rules (1)

T1615 Group Policy Discovery

title: T1615 Group Policy Discovery
id: a3537b36-4740-4498-8265-966b8819b957
description: 'Detection strategy for Group Policy Discovery via gpresult.exe or PowerShell/AD module GPO enumeration cmdlets. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, UserContext, CommandLinePatterns.'
references:
  - https://attack.mitre.org/techniques/T1615
author: Shahrukh Khan
date: 2026-05-15
license: MIT
tags:
  - attack.discovery
  - attack.t1615

logsource:
  product: windows
  service: sysmon

detection:
  selection_eventid:
    EventID: '1'
  selection_gpresult:
    Image|endswith: '\gpresult.exe'
  selection_cmdline:
    CommandLine|contains:
      - 'gpresult'
      - 'Get-GPO'
      - 'Get-DomainGPO'
      - 'Get-GPOReport'
      - 'Get-NetGPO'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection_eventid and (selection_gpresult or selection_cmdline) and not filter_system_account

falsepositives:
  - Legitimate IT troubleshooting via gpresult or PowerShell GPO cmdlets.

level: medium

Explore