Windows: Findstr searches GPP cpassword in SYSVOL XML
Alerts when Windows findstr/find searches SYSVOL XML files for GPP cpassword.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-12-27
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows process executions where find.exe or findstr.exe are used to search for the string "cpassword" within SYSVOL Group Policy XML files. Attackers can use the exposed encrypted cpassword value to recover credentials with tools that decrypt GPP passwords. The detection relies on process creation telemetry, matching the executable name and the presence of specific command-line substrings (.xml, \sysvol\, and cpassword).
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.006/T1552.006.md#atomic-test-1---gpp-passwords-findstr
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_findstr_gpp_passwords.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Findstr searches GPP cpassword in SYSVOL XML"
id: dc350e2a-3c38-4459-bf0c-14227d9bb484
status: test
description: This rule identifies Windows process executions where find.exe or findstr.exe are used to search for the string "cpassword" within SYSVOL Group Policy XML files. Attackers can use the exposed encrypted cpassword value to recover credentials with tools that decrypt GPP passwords. The detection relies on process creation telemetry, matching the executable name and the presence of specific command-line substrings (.xml, \sysvol\, and cpassword).
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.006/T1552.006.md#atomic-test-1---gpp-passwords-findstr
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_findstr_gpp_passwords.yml
author: frack113, Huntrule Team
date: 2021-12-27
modified: 2023-11-11
tags:
- attack.credential-access
- attack.t1552.006
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- \find.exe
- \findstr.exe
- OriginalFileName:
- FIND.EXE
- FINDSTR.EXE
selection_cli:
CommandLine|contains|all:
- cpassword
- \sysvol\
- .xml
condition: all of selection_*
falsepositives:
- Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_gpp_passwords/info.yml
simulation:
- type: atomic-red-team
name: GPP Passwords (findstr)
technique: T1552.006
atomic_guid: 870fe8fb-5e23-4f5f-b89d-dd7fe26f3b5f
license: DRL-1.1
related:
- id: 91a2c315-9ee6-4052-a853-6f6a8238f90d
type: derived