MITRE ATT&CK technique
Group Policy Discovery detection rulesT1615
Group Policy Discovery (T1615) is a MITRE ATT&CK technique in the Discovery tactic. This page lists the 5 community-maintained Sigma detection rules in the library mapped to T1615 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows.
HackTool - SharpUp PrivEsc Tool Execution
criticalDetects the use of SharpUp, a tool for local privilege escalation
windows · process_creation
Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS
highDetects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine
windows · process_creation
Gpresult Display Group Policy Information
mediumDetects cases in which a user uses the built-in Windows utility gpresult to display the Resultant Set of Policy (RSoP) information
windows · process_creation
Potential Reconnaissance Activity Via GatherNetworkInfo.VBS
mediumDetects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine
windows · process_creation
Suspicious GPO Discovery With Get-GPO
lowDetect use of Get-GPO to get one GPO or all the GPOs in a domain.
windows · ps_script