1200KM / detection
T1615 Group Policy Discovery — Detection Rules
Detection workspace for T1615 Group Policy Discovery: 5 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- Suspicious GPO Discovery With Get-GPO · test · low · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
- Gpresult Display Group Policy Information · test · medium · {"product":"windows","category":"process_creation"}
- HackTool - SharpUp PrivEsc Tool Execution · test · critical · {"category":"process_creation","product":"windows"}
- Potential Reconnaissance Activity Via GatherNetworkInfo.VBS · test · medium · {"category":"process_creation","product":"windows"}
- Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS · test · high · {"category":"process_creation","product":"windows"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0055 Detection strategy for Group Policy Discovery on Windows
AN0152 Analytic 0152
Detection of adversary attempts to enumerate Group Policy settings through suspicious command execution (gpresult), PowerShell enumeration (Get-DomainGPO, Get-DomainGPOLocalGroup), and abnormal LDAP queries targeting groupPolicyContainer objects. Defenders observe unusual process lineage, script execution, or LDAP filter activity against domain controllers.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.