Techniques › T1615 › AN0152
AN0152 Analytic 0152
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection of adversary attempts to enumerate Group Policy settings through suspicious command execution (gpresult), PowerShell enumeration (Get-DomainGPO, Get-DomainGPOLocalGroup), and abnormal LDAP queries targeting groupPolicyContainer objects. Defenders observe unusual process lineage, script execution, or LDAP filter activity against domain controllers.</p>
- Detects
- T1615 Group Policy Discovery
- Part of
- DET0055 Detection strategy for Group Policy Discovery on Windows
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4661 | DC0071 Active Directory Object Access |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 | DC0064 Command Execution |
| NSM:Flow | query: High-volume LDAP traffic with filters targeting groupPolicyContainer attributes | DC0085 Network Traffic Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Defines the correlation window to link suspicious PowerShell activity, gpresult execution, and LDAP enumeration. |
UserContext | Identifies accounts expected to perform GPO enumeration (administrators vs. standard users). |
CommandLinePatterns | Patterns for detecting suspicious gpresult or PowerShell cmdlets; tunable to reduce noise in environments where these tools are common. |