Group Policy Preferences password tooling or SYSVOL XML search

Siemphony@siemphonymediumT1552.006unverified

Matches the two command-line steps AN1075 describes, both on `CommandLine` so the whole rule sits in one field. The first arm names the published decryptors and the `cpassword` attribute itself — the XML attribute holding the AES blob, which anything reading or grepping for a Group Policy Preferences password has to name somewhere. The second arm requires a path under SYSVOL together with a reference to XML, which is the enumeration step MITRE spells out in the technique text as `dir /s *.xml` against the policy share — with the caveat that `dir` is a cmd builtin and `Get-ChildItem` a cmdlet, so neither creates a process when typed into a shell that is already open. The second arm therefore sees the `cmd /c` and `powershell -c` one-liner forms, `findstr`, and compiled tooling; it does not see the interactive session, and an operator working from a mapped drive rather than the UNC path misses the `\sysvol` gate as well. MITRE supplies the KnownToolsSignature knob; the term list here is authored. The brief's other three sources were not used: Sysmon EventID 11 is file creation and cannot see a policy file being read, Security 5145 fires for every domain member at every policy refresh, and the PowerShell source is described only as scripts with XML or AES logic, which is not a field-level observable. Vocabulary note — the brief maps Sysmon EventID 1 onto `category: process_creation`, and this rule is written in that vocabulary; an estate feeding Security 4688 into the same category gets `CommandLine` only after enabling *Include command line in process creation events* on top of *Audit Process Creation*, neither of which is on by default. Two limits worth stating: the decryption key is public and the work is offline, so an operator who copies Groups.xml aside with Explorer or robocopy and decrypts it elsewhere leaves no matching command line; and a bespoke script that parses the XML without naming cpassword or a known tool is invisible to both arms. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0381, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((ProcessCommandLine contains "Get-GPPPassword" or ProcessCommandLine contains "gpprefdecrypt" or ProcessCommandLine contains "gpp-decrypt" or ProcessCommandLine contains "gpp_password" or ProcessCommandLine contains "gpp_autologin" or ProcessCommandLine contains "cpassword" or ProcessCommandLine contains "gather/credentials/gpp") or (ProcessCommandLine contains "\\sysvol" and ProcessCommandLine contains ".xml"))

Splunk · SPL

Run this as a search.

index=* ((CommandLine="*Get-GPPPassword*" OR CommandLine="*gpprefdecrypt*" OR CommandLine="*gpp-decrypt*" OR CommandLine="*gpp_password*" OR CommandLine="*gpp_autologin*" OR CommandLine="*cpassword*" OR CommandLine="*gather/credentials/gpp*") OR (CommandLine="*\\sysvol*" AND CommandLine="*.xml*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.command_line) LIKE "*get-gpppassword*" OR TO_LOWER(process.command_line) LIKE "*gpprefdecrypt*" OR TO_LOWER(process.command_line) LIKE "*gpp-decrypt*" OR TO_LOWER(process.command_line) LIKE "*gpp_password*" OR TO_LOWER(process.command_line) LIKE "*gpp_autologin*" OR TO_LOWER(process.command_line) LIKE "*cpassword*" OR TO_LOWER(process.command_line) LIKE "*gather/credentials/gpp*") OR (TO_LOWER(process.command_line) LIKE "*\\\\sysvol*" AND TO_LOWER(process.command_line) LIKE "*.xml*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(Get-GPPPassword|gpprefdecrypt|gpp-decrypt|gpp_password|gpp_autologin|cpassword|gather/credentials/gpp)</field>    <description>Group Policy Preferences password tooling or SYSVOL XML search (1/2)</description>    <mitre>      <id>T1552.006</id>    </mitre>  </rule>   <rule id="100001" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)\\sysvol</field>    <field name="CommandLine" type="pcre2">(?i)\.xml</field>    <description>Group Policy Preferences password tooling or SYSVOL XML search (2/2)</description>    <mitre>      <id>T1552.006</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: credential_dump
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 2ce0c2ec-2a9a-4579-b993-66b655a200f1

ATT&CKT1552.006

T1552.006Group Policy Preferences

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessoncredential dump

credential dumpAI draft — unreviewed

01 · What this rule detects

AN1075 correlates enumeration of XML files on the SYSVOL share with execution of something that reads or decrypts the credentials embedded in Group Policy Preferences files. The rule authors both steps as command-line matches in a single event: one arm for the published decryptors and the cpassword attribute itself, one arm for a path under SYSVOL alongside a reference to XML. There is no correlation between them — either arm alone fires the rule.

02 · Telemetry you need

Process creation on Windows. The brief maps Sysmon EventID 1 onto category: process_creation, and this rule is written in that vocabulary. An estate feeding Security 4688 into the same category gets CommandLine only after enabling Include command line in process creation events on top of Audit Process Creation — neither is on by default. The analytic's other three sources went unused: Sysmon EID 11 is file creation and cannot see a policy file being read, Security 5145 fires for every domain member at every policy refresh, and the PowerShell source is described only as "scripts with XML or AES logic" — not a field-level observable.

03 · How the logic works

Arm 1 is the high-fidelity half. cpassword is the XML attribute holding the AES blob, so anything grepping for a GPP password has to name it somewhere, and the tool names are the ones MITRE lists plus the two the reviewer added: gpp-decrypt (hyphenated, not covered by gpprefdecrypt) and gpp_password (the NetExec module whose sibling gpp_autologin was already there). Arm 2 is weaker than it looks, and the description now says so. dir is a cmd.exe builtin and Get-ChildItem a cmdlet — typed into a shell that is already open, neither creates a process, so MITRE's own exemplar dir /s *.xml is invisible. Arm 2 sees the cmd /c and powershell -c one-liner forms, findstr, and compiled tooling. An operator working from a mapped drive misses the \sysvol gate too. Note the escaping: '\\sysvol' is one literal backslash in Sigma; written with a single backslash it is an undefined escape that some tooling drops, which would silently reduce the gate to "contains sysvol".

04 · Common false positives

Arm 2 carries almost all of it. Scripted GPMC backups, change-control products and Get-GPOReport pipelines name policy XML under SYSVOL on a schedule from a management server, and on any domain running that automation they are the dominant match by a wide margin. SYSVOL replication health checks and file-integrity monitoring walk the same tree as a DC service account at fixed intervals, and inventory scripts run dir /s *.xml against the share to build a CMDB feed. Arm 1 is quieter but not silent: the standard remediation check for leftover GPP passwords is to run Get-GPPPassword or grep for cpassword, so internal audits, purple-team exercises and vendor assessments match it exactly.

05 · Detection maturity

tier_1: **, the lowest tier, and it stays there until it has been run against real data. UNVERIFIED — derived from DET0381, never executed against a log line. Two blind spots survive tuning: the key is public and the work is offline, so copying Groups.xml aside with robocopy and decrypting it elsewhere leaves no matching command line; and a bespoke parser naming neither cpassword nor a known tool is invisible to both arms.
tier_2: means measuring the backup-automation volume and building the filter it implies;
tier_3: means the correlation AN1075 describes — share access joined to execution in a window.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE supplies the KnownToolsSignature, UserContext, HostType and
One level is covering two arms of very different fidelity. Split into two
HostType is the highest-value unencoded knob: enumeration from a

Declared by the author

Group Policy backup, reporting and migration tooling that names policy XML under the SYSVOL path on a schedule — scripted GPMC backups, change-control products and Get-GPOReport pipelines all do this from a management server, and on a domain with that automation in place it is the dominant match for the second arm by a wide margin.
Sanctioned hygiene work, because the standard remediation check for leftover Group Policy Preferences passwords is to run Get-GPPPassword or grep the policy share for cpassword. An internal audit, a purple-team exercise or a vendor assessment matches the first arm exactly, using the same tools for the same strings.
SYSVOL replication health checks and file-integrity monitoring that walk the replicated policy tree and enumerate every .xml file in it, typically as a domain controller service account at a fixed interval.
Documentation and inventory scripts that run dir /s *.xml or a Get-ChildItem equivalent against the policy share to build a GPO inventory or feed a configuration-management database.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1552.006, evaluated against their process_creation events.

Share this rule

/u/siemphony/2ce0c2ec-2a9a-4579-b993-66b655a200f1

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Group Policy Preferences password tooling or SYSVOL XML search

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it