Mirrors/keyboardcrunch-sentinelone-attack-queries
1
0
Fork 0
mirror of https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries synced 2026-06-10 10:07:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

T1552.006 Group Policy Preferences

Browse Source
This commit is contained in:
@
2020-10-23 15:49:37 -05:00
parent c976d3a053
commit 9f3198ba03
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Tactics/CredentialAccess.md
+7
View File
@@ -52,6 +52,13 @@ Focusing here on detecting the Powershell UI.PromptForCredential and GetNetworkC
### T1552.006 Group Policy Preferences ### T1552.006 Group Policy Preferences
Atomics: [T1552.006](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1552.006/T1552.006.md) Atomics: [T1552.006](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1552.006/T1552.006.md)
Detection focuses on sysvol GP Policy xml file enumeration, with findstr or Get-GPPPassword (Alias or CmdScript internal match).
`
TgtProcCmdline RegExp "^.*\/S cpassword.*\\sysvol\\.*.xml" OR
TgtProcCmdline ContainsCIS "Get-GPPPassword" OR
SrcProcCmdScript ContainsCIS "Get-ChildItem -Path \"\\$Server\SYSVOL\" -Recurse -ErrorAction SilentlyContinue -Include 'Groups.xml','Services.xml','Scheduledtasks.xml','DataSources.xml','Printers.xml','Drives.xml'"
`
### T1558.003 Kerberoasting ### T1558.003 Kerberoasting
Atomics: [T1558.003](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1558.003/T1558.003.md) Atomics: [T1558.003](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1558.003/T1558.003.md)