Windows Process Creation: Access to Domain Group Policy in SYSVOL

Flags Windows processes that reference SYSVOL \policies paths in their command line.

FreeUnreviewedSigmamediumv1

windows-process-creation-access-to-domain-group-policy-in-sysvol-05f3c945

title: "Windows Process Creation: Access to Domain Group Policy in SYSVOL"
id: a39f5496-0a66-40ea-b7b0-25524fbb9bca
status: test
description: Identifies Windows processes whose command line contains both the SYSVOL path and the policies directory, indicating access to Group Policy content stored in SYSVOL. Attackers and administrators may interact with these locations to enumerate, modify, or stage policy-related files as part of broader domain abuse. The rule relies on process creation telemetry with access to the full command line string.
references:
  - https://adsecurity.org/?p=2288
  - https://www.hybrid-analysis.com/sample/f2943f5e45befa52fb12748ca7171d30096e1d4fc3c365561497c618341299d5?environmentId=100
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_sysvol_access.yml
author: Markus Neis, Jonhnathan Ribeiro, oscd.community, Huntrule Team
date: 2018-04-09
modified: 2022-01-07
tags:
  - attack.credential-access
  - attack.t1552.006
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - \SYSVOL\
      - \policies\
  condition: selection
falsepositives:
  - Administrative activity
level: medium
license: DRL-1.1
related:
  - id: 05f3c945-dcc8-4393-9f3d-af65077a8f86
    type: derived

What it detects

Identifies Windows processes whose command line contains both the SYSVOL path and the policies directory, indicating access to Group Policy content stored in SYSVOL. Attackers and administrators may interact with these locations to enumerate, modify, or stage policy-related files as part of broader domain abuse. The rule relies on process creation telemetry with access to the full command line string.

Known false positives

Administrative activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.