CmdID

CmdID / Techniques / T1552

T1552.006 Unsecured Credentials: Group Policy Preferences

Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). MITRE ATT&CK

1 program on CmdID 4 Sigma rules T1552.006 on attack.mitre.org

Part of

MITRE ATT&CK
T1552Unsecured Credentials

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
findstr.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first
highFindstr GPP Passwordsfrack113 · Windows
highLSASS Process Reconnaissance Via Findstr.EXEFlorian Roth (Nextron Systems) · Windows
mediumPermission Misconfiguration Reconnaissance Via Findstr.EXENasreddine Bencherchali (Nextron Systems) · Windows
mediumSuspicious SYSVOL Domain Group Policy AccessMarkus Neis, Jonhnathan Ribeiro, oscd.community · Windows