Skip to content

T1615 Group Policy Discovery

Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment. Group Policy allows for centralized management of user and computer settings in Active Directory (AD). Group policy objects (GPOs) are containers for group policy settings made up of files stored within a predictable network path \<DOMAIN>\SYSVOL\<DOMAIN>\Policies\.41

Adversaries may use commands such as gpresult or various publicly available PowerShell functions, such as Get-DomainGPO and Get-DomainGPOLocalGroup, to gather information on Group Policy settings.23 Adversaries may use this information to shape follow-on behaviors, including determining potential attack paths within the target network as well as opportunities to manipulate Group Policy settings (i.e. Domain or Tenant Policy Modification) for their benefit.

Item Value
ID T1615
Sub-techniques
Tactics TA0007
Platforms Windows
Version 1.1
Created 06 August 2021
Last Modified 24 October 2025

Procedure Examples

ID Name Description
S0521 BloodHound BloodHound has the ability to collect local admin information via GPO.5
S1159 DUSTTRAP DUSTTRAP can identify victim environment Group Policy information.7
S0082 Emissary Emissary has the capability to execute gpresult.8
S0363 Empire Empire includes various modules for enumerating Group Policy.3
C0049 Leviathan Australian Intrusions Leviathan performed extensive Active Directory enumeration of victim environments during Leviathan Australian Intrusions.10
S1141 LunarWeb LunarWeb can capture information on group policy settings6
G0010 Turla Turla surveys a system upon check-in to discover Group Policy details using the gpresult command.9

References

  1. Metcalf, S. (2016, March 14). Sneaky Active Directory Persistence #17: Group Policy. Retrieved March 5, 2019. ↩

  2. Microsoft. (2017, October 16). gpresult. Retrieved August 6, 2021. ↩

  3. Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016. ↩↩

  4. srachui. (2012, February 13). Group Policy Basics – Part 1: Understanding the Structure of a Group Policy Object. Retrieved March 5, 2019. ↩

  5. Robbins, A., Vazarkar, R., and Schroeder, W. (2016, April 17). Bloodhound: Six Degrees of Domain Admin. Retrieved March 5, 2019. ↩

  6. Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024. ↩

  7. Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024. ↩

  8. Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016. ↩

  9. Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020. ↩

  10. CISA et al. (2024, July 8). People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action. Retrieved February 3, 2025. ↩