T1552.006 Group Policy Preferences — Attack Simulation

Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts. These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public). The…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

GPP Passwords (findstr)
windows automated command_prompt
Procedure 870fe8fb-5e23-4f5f-b89d-dd7fe26f3b5f; elevation not declared required; cleanup not declared. Not executed or individually validated.
GPP Passwords (Get-GPPPassword)
windows automated powershell
Procedure e9584f82-322c-474a-b831-940fd8b4455c; elevation not declared required; cleanup not declared. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint onprem Windows credential-access isolated_authorized_lab procedure_review_required telemetry_configuration_required

can_simulate subtechnique source_mapped

Detection and collection

T1552.006 detection workspace

Attack tools

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.