Detectionhightest
Findstr GPP Passwords
Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This value can be decrypted with gpp-decrypt.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
Detection Logic
Detection Logic2 selectors
detection:
selection_img:
- Image|endswith:
- '\find.exe'
- '\findstr.exe'
- OriginalFileName:
- 'FIND.EXE'
- 'FINDSTR.EXE'
selection_cli:
CommandLine|contains|all:
- 'cpassword'
- '\sysvol\'
- '.xml'
condition: all of selection_*False Positives
Unknown
False positive likelihood has not been assessed. Additional context may be needed during triage.
References
Testing & Validation
Simulations
atomic-red-teamT1552.006
View on ARTGPP Passwords (findstr)
GUID: 870fe8fb-5e23-4f5f-b89d-dd7fe26f3b5f
MITRE ATT&CK
Tactics
Sub-techniques
Rule Metadata
Rule ID
91a2c315-9ee6-4052-a853-6f6a8238f90d
Status
test
Level
high
Type
Detection
Created
Mon Dec 27
Modified
Sat Nov 11
Author
Path
rules/windows/process_creation/proc_creation_win_findstr_gpp_passwords.yml
Raw Tags
attack.credential-accessattack.t1552.006