Windows PowerShell: Suspicious GPO Enumeration via Get-GPO

Detects PowerShell script blocks using Get-GPO to enumerate domain Group Policy Objects.

FreeUnreviewedSigmalowv1

windows-powershell-suspicious-gpo-enumeration-via-get-gpo-eb2fd349

title: "Windows PowerShell: Suspicious GPO Enumeration via Get-GPO"
id: 3dd835a0-db8d-47ff-85ea-7b6379ba05fb
status: test
description: This rule flags PowerShell script block content containing the Get-GPO cmdlet, indicating an attempt to enumerate Group Policy Objects in a domain (for a specific GPO or all GPOs). Attackers may use GPO discovery to identify configuration targets and opportunities for further compromise. Telemetry relies on Script Block Logging capturing the PowerShell script text for analysis of the cmdlet string.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1615/T1615.md
  - https://learn.microsoft.com/en-us/powershell/module/grouppolicy/get-gpo?view=windowsserver2022-ps
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_get_gpo.yml
author: frack113, Huntrule Team
date: 2022-06-04
tags:
  - attack.discovery
  - attack.t1615
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains: Get-GPO
  condition: selection
falsepositives:
  - Legitimate PowerShell scripts
level: low
license: DRL-1.1
related:
  - id: eb2fd349-ec67-4caa-9143-d79c7fb34441
    type: derived

What it detects

This rule flags PowerShell script block content containing the Get-GPO cmdlet, indicating an attempt to enumerate Group Policy Objects in a domain (for a specific GPO or all GPOs). Attackers may use GPO discovery to identify configuration targets and opportunities for further compromise. Telemetry relies on Script Block Logging capturing the PowerShell script text for analysis of the cmdlet string.

Known false positives

Legitimate PowerShell scripts

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.