Splunk unknown stable spl
Windows PowerSploit GPP Discovery
The following analytic detects the execution of the Get-GPPPassword PowerShell cmdlet, which is used to search for unsecured credentials in Group Policy Preferences (GPP). This detection leverages PowerShell Script Block Logging to identify specific script block text associated with this cmdlet. Monitoring this activity is crucial as it can indicate an attempt to retrieve and decrypt stored credentials from SYSVOL, potentially leading to unauthorized access. If confirmed malicious, this activity could allow an attacker to escalate privileges or move laterally within the network by exploiting exposed credentials.
Detection Logic
`powershell` EventCode=4104 (ScriptBlockText=Get-GPPPassword
OR ScriptBlockText=Get-CachedGPPPassword)
| fillnull
| stats count min(_time) as firstTime max(_time) as lastTime
BY dest signature signature_id
user_id vendor_product EventID
Guid Opcode Name
Path ProcessID ScriptBlockId
ScriptBlockText
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_powersploit_gpp_discovery_filter`False Positives
- ⚠ No false positives have been identified at this time.
Field Validations
Loading…
Comments (0)
Loading comments...