ATT&CK technique
View on MITRE ATT&CK →
T1552.006
Group Policy Preferences
Credential Access
9 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Potential PowerShell HackTool Script by Function Names | production | 2026-09-18 |
| splunk | Windows Findstr GPP Discovery | production | 2026-05-13 |
| splunk | Windows PowerSploit GPP Discovery | production | 2026-05-13 |
| sigma | Access To Potentially Sensitive Sysvol Files By Uncommon Applications | test | 2024-07-29 |
| sigma | LSASS Process Reconnaissance Via Findstr.EXE | test | 2024-06-04 |
| sigma | Access To Sysvol Policies Share By Uncommon Process | test | 2023-12-21 |
| sigma | Permission Misconfiguration Reconnaissance Via Findstr.EXE | test | 2023-11-11 |
| sigma | Findstr GPP Passwords | test | 2023-11-11 |
| sigma | Suspicious SYSVOL Domain Group Policy Access | test | 2022-01-07 |