Windows findstr Searches for GPP cpassword in SYSVOL XML

title: Windows findstr Searches for GPP cpassword in SYSVOL XML
id: dc350e2a-3c38-4459-bf0c-14227d9bb484
status: test
description: This rule flags Windows process executions of find.exe or findstr.exe where the command line includes the string cpassword along with references to the SYSVOL directory and XML files. Attackers can use this pattern to locate Group Policy Preferences files that contain encrypted credentials. The detection relies on process creation telemetry, specifically the image path and the command line content.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.006/T1552.006.md#atomic-test-1---gpp-passwords-findstr
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_findstr_gpp_passwords.yml
author: frack113, Huntrule Team
date: 2021-12-27
modified: 2023-11-11
tags:
  - attack.credential-access
  - attack.t1552.006
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \find.exe
        - \findstr.exe
    - OriginalFileName:
        - FIND.EXE
        - FINDSTR.EXE
  selection_cli:
    CommandLine|contains|all:
      - cpassword
      - \sysvol\
      - .xml
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_gpp_passwords/info.yml
simulation:
  - type: atomic-red-team
    name: GPP Passwords (findstr)
    technique: T1552.006
    atomic_guid: 870fe8fb-5e23-4f5f-b89d-dd7fe26f3b5f
license: DRL-1.1
related:
  - id: 91a2c315-9ee6-4052-a853-6f6a8238f90d
    type: derived