Group Policy enumeration via gpresult or GPO cmdlets

Siemphony@siemphonylowT1615unverifiedPlaybook · Discovery and enumeration

Matches the command line of a process that names a Group Policy enumeration tool. AN0152 names two of them itself — gpresult and the PowerView function Get-DomainGPO; the substring match on Get-DomainGPO also covers Get-DomainGPOLocalGroup, the third name in the analytic. The remaining values are added here, not sourced from MITRE: the RSAT GroupPolicy cmdlets Get-GPO and Get-GPResultantSetOfPolicy, and Get-NetGPO, the PowerView v2 name for the same enumeration function. It is a single CommandLine list rather than an Image list plus a keyword search, so the invocation is caught whether the binary is launched directly or wrapped in powershell.exe -Command, and so every backend renders one field. AN0152's other two legs are not written here: its Security 4661 leg needs a SACL on the domain's groupPolicyContainer objects and an object-type GUID match that this brief supplies no field names for, and its PowerShell 4103/4104 leg is a different logsource. Two limitations follow from matching a command line and belong in the reader's expectations rather than in the false positives — a cmdlet typed at an interactive prompt or called from inside a .ps1 never reaches a command line at all, and a base64 -EncodedCommand hides the name. The telemetry is Sysmon EventID 1 per the brief; sourced from Security 4688 instead it needs *Audit Process Creation* plus the separate *Include command line in process creation events* policy, neither on by default. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0055, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Group Policy enumeration via gpresult or GPO cmdlets2id: 7eeb9ce4-ca31-48e1-a606-8b887cec8c3b3status: experimental4description: |5  Matches the command line of a process that names a Group Policy enumeration6  tool. AN0152 names two of them itself — gpresult and the PowerView function7  Get-DomainGPO; the substring match on Get-DomainGPO also covers8  Get-DomainGPOLocalGroup, the third name in the analytic. The remaining values9  are added here, not sourced from MITRE: the RSAT GroupPolicy cmdlets Get-GPO10  and Get-GPResultantSetOfPolicy, and Get-NetGPO, the PowerView v2 name for the11  same enumeration function. It is a single CommandLine list12  rather than an Image list plus a keyword search, so the invocation is caught13  whether the binary is launched directly or wrapped in powershell.exe -Command,14  and so every backend renders one field. AN0152's other two legs are not15  written here: its Security 4661 leg needs a SACL on the domain's16  groupPolicyContainer objects and an object-type GUID match that this brief17  supplies no field names for, and its PowerShell 4103/4104 leg is a different18  logsource. Two limitations follow from matching a command line and belong in19  the reader's expectations rather than in the false positives — a cmdlet typed20  at an interactive prompt or called from inside a .ps1 never reaches a command21  line at all, and a base64 -EncodedCommand hides the name. The telemetry is22  Sysmon EventID 1 per the brief; sourced from Security 4688 instead it needs23  *Audit Process Creation* plus the separate *Include command line in process24  creation events* policy, neither on by default.25  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0055, not hand-written and not tested by its author. Any lab result is on this rule's own page.26references:27  - https://attack.mitre.org/techniques/T161528  - https://attack.mitre.org/detectionstrategies/DET005529author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)30date: 2026-08-1631tags:32  - attack.discovery33  - attack.t161534logsource:35  category: process_creation36  product: windows37detection:38  selection:39    CommandLine|contains:40      - 'gpresult'41      - 'Get-GPO'42      - 'Get-GPResultantSetOfPolicy'43      - 'Get-DomainGPO'44      - 'Get-NetGPO'45  condition: selection46falsepositives:47  - "Helpdesk troubleshooting. Running gpresult /r or gpresult /h against a user's machine is the standard first move on any policy complaint, and on a support workstation it is the loudest match this rule has — which is why the level is low and why MITRE's UserContext knob (which accounts are expected to enumerate policy) is the practical filter."48  - "Scheduled inventory, compliance and health-check scripts that shell out to gpresult on every managed endpoint, producing a periodic burst across the whole estate under SYSTEM or the management agent's account."49  - "Group Policy administration from RSAT. Backup, documentation and change-review scripts call Get-GPO and Get-GPOReport routinely, and Get-GPOReport matches the Get-GPO entry as a substring."50  - "Security baselining and audit tooling that captures applied policy with Get-GPResultantSetOfPolicy, including some CIS and vendor hardening assessment scripts."51level: low

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (ProcessCommandLine contains "gpresult" or ProcessCommandLine contains "Get-GPO" or ProcessCommandLine contains "Get-GPResultantSetOfPolicy" or ProcessCommandLine contains "Get-DomainGPO" or ProcessCommandLine contains "Get-NetGPO")

Splunk · SPL

Run this as a search.

index=* (CommandLine="*gpresult*" OR CommandLine="*Get-GPO*" OR CommandLine="*Get-GPResultantSetOfPolicy*" OR CommandLine="*Get-DomainGPO*" OR CommandLine="*Get-NetGPO*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.command_line) LIKE "*gpresult*" OR TO_LOWER(process.command_line) LIKE "*get-gpo*" OR TO_LOWER(process.command_line) LIKE "*get-gpresultantsetofpolicy*" OR TO_LOWER(process.command_line) LIKE "*get-domaingpo*" OR TO_LOWER(process.command_line) LIKE "*get-netgpo*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(gpresult|Get-GPO|Get-GPResultantSetOfPolicy|Get-DomainGPO|Get-NetGPO)</field>    <description>Group Policy enumeration via gpresult or GPO cmdlets</description>    <mitre>      <id>T1615</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 7eeb9ce4-ca31-48e1-a606-8b887cec8c3b

ATT&CKT1615

T1615Group Policy Discovery

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1615, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE's knobs for AN0152 are TimeWindow, UserContext and CommandLinePatterns; the five values in the selection populate the last of those and are the pipeline's, not MITRE's. UserContext is the practical filter — decide which accounts are expected to enumerate policy and exclude them, rather than removing values. Then add an Image|endswith gate on \gpresult.exe, \powershell.exe, \pwsh.exe, \cmd.exe and \wmiprvse.exe ANDed with the list, which kills the filename-reference noise outright. Note that PowerShell resolves unambiguous prefixes, so Get-GPResul runs the cmdlet and misses the selector, and -EncodedCommand hides the name entirely. Level low is honest given the helpdesk volume.

Declared by the author

Helpdesk troubleshooting. Running gpresult /r or gpresult /h against a user's machine is the standard first move on any policy complaint, and on a support workstation it is the loudest match this rule has — which is why the level is low and why MITRE's UserContext knob (which accounts are expected to enumerate policy) is the practical filter.
Scheduled inventory, compliance and health-check scripts that shell out to gpresult on every managed endpoint, producing a periodic burst across the whole estate under SYSTEM or the management agent's account.
Group Policy administration from RSAT. Backup, documentation and change-review scripts call Get-GPO and Get-GPOReport routinely, and Get-GPOReport matches the Get-GPO entry as a substring.
Security baselining and audit tooling that captures applied policy with Get-GPResultantSetOfPolicy, including some CIS and vendor hardening assessment scripts.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

Group Policy enumeration, spotted by the name of the tool appearing on a process command line. AN0152 describes three observables — gpresult execution, PowerShell enumeration, and LDAP queries against groupPolicyContainer objects. This rule implements only the first shape. Its practical reach is narrower than its value list suggests, and that gap is the most important thing to understand about it.

02 · Telemetry you need

process_creation on Windows, copied verbatim from AN0152's Sysmon EventID 1 entry, which supplies CommandLine with no extra configuration. Sourced from Security 4688 instead, it needs Audit Process Creation plus the separate Include command line in process creation events policy — neither is on by default, and without the second one CommandLine is blank and the rule matches nothing while looking healthy. The analytic's other two legs need telemetry this rule does not use: 4661 requires a SACL on the domain's groupPolicyContainer objects, and the PowerShell leg (4103/4104) requires Script Block Logging, which is also off by default.

03 · How the logic works

One selection, one field. CommandLine|contains against five values: gpresult, Get-GPO, Get-GPResultantSetOfPolicy, Get-DomainGPO and Get-NetGPO. The condition is simply selection. AN0152 names gpresult, Get-DomainGPO and Get-DomainGPOLocalGroup. The first two are in the list directly; the third is covered incidentally, since Get-DomainGPO is a substring of it. The RSAT cmdlets Get-GPO and Get-GPResultantSetOfPolicy, and Get-NetGPO (the PowerView v2 alias), are the pipeline's own additions and are not MITRE values. Now the caveat. Only gpresult reliably reaches a command line, because it is a binary. The four cmdlet values only appear when someone runs powershell.exe -Command "Get-DomainGPO". PowerView is normally loaded into a live session and called at the prompt; RSAT cmdlets are typed interactively or run from a .ps1. In all of those the name lives in the script block, not the command line. Treat this as a gpresult detector with four optimistic extras, and understand that AN0152's 4104 leg is not an alternative — it is the only place the cmdlet coverage can actually come from. There is also no Image gate. A bare contains on gpresult matches notepad.exe C:\reports\gpresult.html, a log shipper reading gpresult-output.txt, or an archiver zipping the report. Those are file-path references, not policy enumeration.

04 · Common false positives

Helpdesk work is the loudest source by a distance: gpresult /r and gpresult /h are the standard first move on any policy complaint, so a support workstation will generate a steady stream. Behind that sit scheduled inventory and compliance scripts that shell out to gpresult across the whole estate on a cadence, GPO backup and documentation scripts calling Get-GPO (and Get-GPOReport, which matches as a substring), and hardening assessment tooling that captures applied policy with Get-GPResultantSetOfPolicy. Add the filename-reference matches described above, which none of the rule's own false positives cover.

05 · Detection maturity

tier_1: Lowest tier. Derived from DET0055 and never executed against a log line, so there is no measured volume, no tuned allowlist and no confirmation it fires on the technique. Run it in audit mode over your own history first.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/7eeb9ce4-ca31-48e1-a606-8b887cec8c3b

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Group Policy enumeration via gpresult or GPO cmdlets

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it