Windows PowerShell: Suspicious GPO Discovery via Get-GPO
Detects PowerShell script blocks using Get-GPO to enumerate domain Group Policy Objects.
FreeReviewedSigma · Low · v2
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-06-04
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell script block text containing Get-GPO, indicating an attempt to enumerate Group Policy Objects in a domain. Attackers often use GPO discovery to understand configuration and identify misconfigurations or targets for later abuse. It relies on script block logging telemetry capturing PowerShell code executed on Windows.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1615/T1615.md
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/grouppolicy/get-gpo?view=windowsserver2022-ps
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_get_gpo.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-powershell-suspicious-gpo-enumeration-via-get-gpo-eb2fd349
title: "Windows PowerShell: Suspicious GPO Discovery via Get-GPO"
id: 3dd835a0-db8d-47ff-85ea-7b6379ba05fb
status: test
description: This rule flags PowerShell script block text containing Get-GPO, indicating an attempt to enumerate Group Policy Objects in a domain. Attackers often use GPO discovery to understand configuration and identify misconfigurations or targets for later abuse. It relies on script block logging telemetry capturing PowerShell code executed on Windows.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1615/T1615.md
- https://learn.microsoft.com/en-us/powershell/module/grouppolicy/get-gpo?view=windowsserver2022-ps
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_get_gpo.yml
author: frack113, Huntrule Team
date: 2022-06-04
tags:
- attack.discovery
- attack.t1615
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains: Get-GPO
condition: selection
falsepositives:
- Legitimate PowerShell scripts
level: low
license: DRL-1.1
related:
- id: eb2fd349-ec67-4caa-9143-d79c7fb34441
type: derived