T1615 Group Policy Discovery — Attack Simulation

Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment. Group Policy allows for centralized management of user and computer settings in Active Directory (AD). Group policy objects (GPOs) are containers for group policy settings made up of files stored…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Display group policy information via gpresult
windows automated command_prompt
Procedure 0976990f-53b1-4d3f-a185-6df5be429d3b; elevation not declared required; cleanup not declared. Not executed or individually validated.
Get-DomainGPO to display group policy information via PowerView
windows automated powershell
Procedure 4e524c4e-0e02-49aa-8df5-93f3f7959b9f; elevation required; cleanup not declared. Not executed or individually validated.
MSFT Get-GPO Cmdlet
windows automated powershell
Procedure 52778a8f-a10b-41a4-9eae-52ddb74072bf; elevation required; cleanup present, not reviewed. Not executed or individually validated.
WinPwn - GPORemoteAccessPolicy
windows automated powershell
Procedure 7230d01a-0a72-4bd5-9d7f-c6d472bc6a59; elevation not declared required; cleanup not declared. Not executed or individually validated.
WinPwn - GPOAudit
windows automated powershell
Procedure bc25c04b-841e-4965-855f-d1f645d7ab73; elevation not declared required; cleanup not declared. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint onprem Windows discovery isolated_authorized_lab procedure_review_required telemetry_configuration_required some_candidates_require_elevation

can_simulate technique source_mapped

Detection and collection

T1615 detection workspace

Attack tools

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Turla · G0010

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.