Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1552.006: Group Policy Preferences

Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts.[1]

These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public).[2]

The following tools and scripts can be used to gather and decrypt the password file from Group Policy Preference XML files:

* Metasploit’s post exploitation module: post/windows/gather/credentials/gpp * Get-GPPPassword[3] * gpprefdecrypt.py

On the SYSVOL share, adversaries may use the following command to enumerate potential GPP XML files: dir /s * .xml

EnterpriseT1552.006Sub-techniqueObject v1.1 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Group Policy Preferences credential exposure matters because it can turn ordinary domain user access into access to reusable Windows credentials if legacy GPP password data remains in SYSVOL. Since SYSVOL is readable by domain users and the GPP password encryption key is public, this is primarily a hygiene, audit, and identity-risk issue: defenders need to prove that old embedded credentials are not present and that access to relevant evidence is monitored.

Executive priority

Prioritize this as an Active Directory credential exposure risk. The business decision is not whether attackers can use a novel exploit, but whether legacy administrative practice has left decryptable credentials in a location normal domain users can read. Security leaders should ask for evidence that SYSVOL has been reviewed for GPP credential artifacts, that AD configuration practices no longer rely on embedded local account passwords, and that SOC/IR teams can identify suspicious access to GPP-related files. This supports incident readiness, audit evidence, and identity control assurance for Windows domain environments.

Technical view

This is a Windows credential-access sub-technique under Unsecured Credentials. Validate whether Group Policy Preference XML files in SYSVOL contain embedded credential material, whether legacy GPP use is still present, and whether detections cover access and decryption activity associated with GPP credentials. ATT&CK provides no detection text for the technique, but the relationship to DET0381 indicates a relevant detection strategy: detecting access and decryption of GPP credentials in SYSVOL. Relationship context also shows use by PowerSploit, SILENTTRINITY, MirrorStealer, APT33, and Wizard Spider, so defenders should include PowerShell and post-exploitation framework activity in triage context without assuming attribution.

Likely telemetry

  • Windows domain controller and file share access logs for SYSVOL
  • File access or object access auditing for Group Policy Preference XML files where enabled
  • PowerShell execution and script block/module logging where available
  • Endpoint process creation telemetry involving searches of SYSVOL or GPP-related files
  • Security event logs related to domain user access patterns and administrative account use

Detection direction

  • Validate coverage against DET0381-style behavior: access to and attempted decryption of GPP credential data in SYSVOL.
  • Tune for unusual domain user enumeration or access to GPP XML content, especially when paired with PowerShell or known post-exploitation frameworks referenced in ATT&CK relationships.
  • Account for false positives from legitimate administrators, Group Policy maintenance, security audits, and configuration management tools.
  • Do not rely only on malware or tool names; the risk comes from readable SYSVOL content and publicly decryptable GPP password data.
  • Confirm logging is enabled before assuming visibility, because ATT&CK does not provide native detection guidance for this sub-technique.

Mitigation priorities

  • First, audit SYSVOL and Group Policy Preferences for embedded credential artifacts and document remediation status.
  • Remove legacy GPP-stored passwords and avoid administrative practices that embed reusable credentials in domain policy files.
  • Apply robust Active Directory configuration controls consistent with M1015, including secure account and policy configuration to reduce credential exposure and lateral movement risk.
  • Maintain audit practices consistent with M1047 so reviews of AD configuration, SYSVOL content, and relevant access logs are repeatable and compliance-supporting.
  • Keep Windows and related infrastructure updated consistent with M1051, while recognizing that patching alone does not replace finding and removing legacy credential artifacts.
Analyst notes and limits

The materiality of this technique is driven by default domain-user readability of SYSVOL combined with the public GPP AES key described in the official references. In practice, the key question for defenders is whether legacy GPP credential files still exist and whether the SOC can see access to them. Relationship context adds useful triage pivots around known groups and software, but those relationships should not be treated as evidence of current activity in any specific environment.

The official ATT&CK detection field is not provided, so detection recommendations are derived from the object description and the DET0381 relationship. Local conclusions require environment evidence such as SYSVOL contents, AD configuration, enabled auditing, endpoint telemetry, and known administrative workflows.

Official MITRE ATT&CK definition

Group Policy Preferences

Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts.[1]

These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public).[2]

The following tools and scripts can be used to gather and decrypt the password file from Group Policy Preference XML files:

* Metasploit’s post exploitation module: post/windows/gather/credentials/gpp * Get-GPPPassword[3] * gpprefdecrypt.py

On the SYSVOL share, adversaries may use the following command to enumerate potential GPP XML files: dir /s * .xml

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
Domain ID Name Relationship / procedure
Enterprise T1552 Unsecured Credentials This object subtechnique of Unsecured Credentials.
Associated objects

Groups, software, and campaigns

Group Enterprise

G0064: APT33

APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.[1][2]

Group Enterprise

G0102: Wizard Spider

Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.[1][2][3]

Tool Enterprise

S0692: SILENTTRINITY

SILENTTRINITY is an open source remote administration and post-exploitation framework primarily written in Python that includes stagers written in Powershell, C, and Boo. SILENTTRINITY was used in a 2019 campaign against Croatian government agencies by unidentified cyber actors.[1][2]

Windows
Tool Enterprise

S0194: PowerSploit

PowerSploit is an open source, offensive security framework comprised of PowerShell modules and scripts that perform a wide range of tasks related to penetration testing such as code execution, persistence, bypassing anti-virus, recon, and exfiltration. [1] [2] [3]

Windows
Relationship explorer

All related ATT&CK context

subtechnique of · Technique T1552: Unsecured Credentials Enterprise uses · Tool S0692: SILENTTRINITY Enterprise uses · Tool S0194: PowerSploit Enterprise uses · Malware S9022: MirrorStealer Enterprise uses · Group G0064: APT33 Enterprise mitigates · Mitigation M1047: Audit Enterprise uses · Group G0102: Wizard Spider Enterprise mitigates · Mitigation M1051: Update Software Enterprise mitigates · Mitigation M1015: Active Directory Configuration Enterprise detects · Detection Strategy DET0381: Detect Access and Decryption of Group Policy Preference (GPP) Credentials in SYSVOL Enterprise
Mitigations

Mitigation direction

Mitigation Enterprise

M1047: Audit

Auditing is the process of recording activity and systematically reviewing and analyzing the activity and system configurations. The primary purpose of auditing is to detect anomalies and identify potential threats or weaknesses in the environment. Proper auditing configurations can also help to meet compliance requirements. The process of auditing encompasses regular analysis of user behaviors and system logs in support of proactive security measures.

Auditing is applicable to all systems used within an organization, from the front door of a building to accessing a file on a fileserver. It is considered more critical for regulated industries such as, healthcare, finance and government where compliance requirements demand stringent tracking of user and system activates.This mitigation can be implemented through the following measures:

System Audit:

- Use Case: Regularly assess system configurations to ensure compliance with organizational security policies. - Implementation: Use tools to scan for deviations from established benchmarks.

Permission Audits:

- Use Case: Review file and folder permissions to minimize the risk of unauthorized access or privilege escalation. - Implementation: Run access reviews to identify users or groups with excessive permissions.

Software Audits:

- Use Case: Identify outdated, unsupported, or insecure software that could serve as an attack vector. - Implementation: Use inventory and vulnerability scanning tools to detect outdated versions and recommend secure alternatives.

Configuration Audits:

- Use Case: Evaluate system and network configurations to ensure secure settings (e.g., disabled SMBv1, enabled MFA). - Implementation: Implement automated configuration scanning tools like SCAP (Security Content Automation Protocol) to identify non-compliant systems.

Network Audits:

- Use Case: Examine network traffic, firewall rules, and endpoint communications to identify unauthorized or insecure connections. - Implementation: Utilize tools such as Wireshark, or Zeek to monitor and log suspicious network behavior.

Mitigation Enterprise

M1051: Update Software

Software updates ensure systems are protected against known vulnerabilities by applying patches and upgrades provided by vendors. Regular updates reduce the attack surface and prevent adversaries from exploiting known security gaps. This includes patching operating systems, applications, drivers, and firmware. This mitigation can be implemented through the following measures:

Regular Operating System Updates

- Implementation: Apply the latest Windows security updates monthly using WSUS (Windows Server Update Services) or a similar patch management solution. Configure systems to check for updates automatically and schedule reboots during maintenance windows. - Use Case: Prevents exploitation of OS vulnerabilities such as privilege escalation or remote code execution.

Application Patching

- Implementation: Monitor Apache's update release notes for security patches addressing vulnerabilities. Schedule updates for off-peak hours to avoid downtime while maintaining security compliance. - Use Case: Prevents exploitation of web application vulnerabilities, such as those leading to unauthorized access or data breaches.

Firmware Updates

- Implementation: Regularly check the vendor’s website for firmware updates addressing vulnerabilities. Plan for update deployment during scheduled maintenance to minimize business disruption. - Use Case: Protects against vulnerabilities that adversaries could exploit to gain access to network devices or inject malicious traffic.

Emergency Patch Deployment

- Implementation: Use the emergency patch deployment feature of the organization's patch management tool to apply updates to all affected Exchange servers within 24 hours. - Use Case: Reduces the risk of exploitation by rapidly addressing critical vulnerabilities.

Centralized Patch Management

- Implementation: Implement a centralized patch management system, such as SCCM or ManageEngine, to automate and track patch deployment across all environments. Generate regular compliance reports to ensure all systems are updated. - Use Case: Streamlines patching processes and ensures no critical systems are missed.

*Tools for Implementation*

Patch Management Tools:

- WSUS: Manage and deploy Microsoft updates across the organization. - ManageEngine Patch Manager Plus: Automate patch deployment for OS and third-party apps. - Ansible: Automate updates across multiple platforms, including Linux and Windows.

Vulnerability Scanning Tools:

- OpenVAS: Open-source vulnerability scanning to identify missing patches.

Mitigation Enterprise

M1015: Active Directory Configuration

Implement robust Active Directory (AD) configurations using group policies to secure user accounts, control access, and minimize the attack surface. AD configurations enable centralized control over account settings, logon policies, and permissions, reducing the risk of unauthorized access and lateral movement within the network. This mitigation can be implemented through the following measures:

Account Configuration:

- Implementation: Use domain accounts instead of local accounts to leverage AD’s centralized management, including group policies, auditing, and access control. - Use Case: For IT staff managing shared resources, provision domain accounts that allow IT teams to log in centrally, reducing the risk of unmanaged, rogue local accounts on individual machines.

Interactive Logon Restrictions:

- Implementation: Configure group policies to restrict interactive logons (e.g., direct physical or RDP logons) for service accounts or privileged accounts that do not require such access. - Use Case: Prevent service accounts, such as SQL Server accounts, from having interactive logon privileges. This reduces the risk of these accounts being leveraged for lateral movement if compromised.

Remote Desktop Settings:

- Implementation: Limit Remote Desktop Protocol (RDP) access to specific, authorized accounts. Use group policies to enforce this, allowing only necessary users to establish RDP sessions. - Use Case: On sensitive servers (e.g., domain controllers or financial databases), restrict RDP access to administrative accounts only, while all other users are denied access.

Dedicated Administrative Accounts:

- Implementation: Create domain-wide administrative accounts that are restricted from interactive logons, designed solely for high-level tasks (e.g., software installation, patching). - Use Case: Create separate administrative accounts for different purposes, such as one set of accounts for installations and another for managing repository access. This limits exposure and helps reduce attack vectors.

Authentication Silos:

- Implementation: Configure Authentication Silos in AD, using group policies to create access zones with restrictions based on membership, such as the Protected Users security group. This restricts access to critical accounts and minimizes exposure to potential threats. - Use Case: Place high-risk or high-value accounts, such as executive or administrative accounts, in an Authentication Silo with extra controls, limiting their exposure to only necessary systems. This reduces the risk of credential misuse or abuse if these accounts are compromised.

**Tools for Implementation**:

- Active Directory Group Policies: Use Group Policy Management Console (GPMC) to configure, deploy, and enforce policies across AD environments. - PowerShell: Automate account configuration, logon restrictions, and policy application using PowerShell scripts. - AD Administrative Center: Manage Authentication Silos and configure high-level policies for critical user groups within AD.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
be8a3e8722660eb3...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.1 Current bundle be8a3e872266…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Microsoft GPP 2016

    Microsoft. (2016, August 31). Group Policy Preferences. Retrieved March 9, 2020.

    Open source URL
  2. [2]
    Microsoft GPP Key

    Microsoft. (n.d.). 2.2.1.1.4 Password Encryption. Retrieved April 11, 2018.

    Open source URL
  3. [3]
    Obscuresecurity Get-GPPPassword

    Campbell, C. (2012, May 24). GPP Password Retrieval with PowerShell. Retrieved April 11, 2018.

    Open source URL
  4. [4]
    ADSecurity Finding Passwords in SYSVOL

    Sean Metcalf. (2015, December 28). Finding Passwords in SYSVOL & Exploiting Group Policy Preferences. Retrieved February 17, 2020.

    Open source URL
  5. [5]
    mitre-attack T1552.006
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use