MITRE ATT&CKsub-technique

T1552.006 Group Policy Preferences

Published 2020-02-11 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Credential Access
Platforms
Windows
Version
1.1
Created
2020-02-11

Description

Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts. These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public). The following tools and scripts can be used to gather and decrypt the password file from Group Policy Preference XML files: • Metasploit’s post exploitation module: post/windows/gather/credentials/gpp • Get-GPPPassword • gpprefdecrypt.py On the SYSVOL share, adversaries may use the following command to enumerate potential GPP XML files: dir /s * .xml

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1552 Unsecured Credentials technique

Tactic · MITRE ATT&CK (1)

  • TA0006 Credential Access tactic

Referenced by MITRE ATT&CK · mitigates (3)

  • M1047 Audit mitigation
  • M1051 Update Software mitigation
  • M1015 Active Directory Configuration mitigation

Referenced by MITRE ATT&CK · uses (5)

  • S9022 MirrorStealer software (malware)
  • S0692 SILENTTRINITY software (tool)
  • G0102 Wizard Spider group
  • G0064 APT33 group
  • S0194 PowerSploit software (tool)

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-639 Probe System Files attack pattern

Referenced by Compliance · mitigates (14)

  • CIS-7.3 Perform Automated Operating System Patch Management CIS Safeguard v8.1
  • CIS-7.7 Remediate Detected Vulnerabilities CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SA-11 Developer Testing and Evaluation NIST 800-53 control
  • NIST-SA-15 Development Process, Standards, and Tools NIST 800-53 control
  • NIST-SI-2 Flaw Remediation NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References