{"id":"05f3c945-dcc8-4393-9f3d-af65077a8f86","title":"Suspicious SYSVOL Domain Group Policy Access","description":"Detects Access to Domain Group Policies stored in SYSVOL","author":"Markus Neis, Jonhnathan Ribeiro, oscd.community","status":"test","level":"medium","date":"2018-04-09","modified":"2022-01-07","tags":["attack.credential-access","attack.t1552.006"],"technique_ids":["T1552.006"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Administrative activity"],"references":["https://adsecurity.org/?p=2288","https://www.hybrid-analysis.com/sample/f2943f5e45befa52fb12748ca7171d30096e1d4fc3c365561497c618341299d5?environmentId=100"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_sysvol_access.yml","source_sha256":"626ac7dd7009f72f4106ce12ba27ae20524a86d486e145c870361b5c7a2d9dc2","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_sysvol_access.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious SYSVOL Domain Group Policy Access\nid: 05f3c945-dcc8-4393-9f3d-af65077a8f86\nstatus: test\ndescription: Detects Access to Domain Group Policies stored in SYSVOL\nreferences:\n    - https://adsecurity.org/?p=2288\n    - https://www.hybrid-analysis.com/sample/f2943f5e45befa52fb12748ca7171d30096e1d4fc3c365561497c618341299d5?environmentId=100\nauthor: Markus Neis, Jonhnathan Ribeiro, oscd.community\ndate: 2018-04-09\nmodified: 2022-01-07\ntags:\n    - attack.credential-access\n    - attack.t1552.006\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains|all:\n            - '\\SYSVOL\\'\n            - '\\policies\\'\n    condition: selection\nfalsepositives:\n    - Administrative activity\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1552.006","id":"T1552.006","name":"Group Policy Preferences","page":"techniques/enterprise/T1552.006/"}],"data_path":"data/detection-rules/05f3c945-dcc8-4393-9f3d-af65077a8f86.json","kind":"sigma"}