Windows Process Creation: Access to Domain Group Policy in SYSVOL
Flags Windows processes that reference SYSVOL \policies paths in their command line.
- Product
- windows
- Category
- process_creation
- Author
- Markus Neis, Jonhnathan Ribeiro, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2018-04-09
- Updated
- 2026-07-30
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
Identifies Windows processes whose command line contains both the SYSVOL path and the policies directory, indicating access to Group Policy content stored in SYSVOL. Attackers and administrators may interact with these locations to enumerate, modify, or stage policy-related files as part of broader domain abuse. The rule relies on process creation telemetry with access to the full command line string.
Reporting behind it
- adsecurity.orghttps://adsecurity.org/?p=2288
- hybrid-analysis.comhttps://www.hybrid-analysis.com/sample/f2943f5e45befa52fb12748ca7171d30096e1d4fc3c365561497c618341299d5?environmentId=100
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_sysvol_access.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Access to Domain Group Policy in SYSVOL"
id: a39f5496-0a66-40ea-b7b0-25524fbb9bca
status: test
description: Identifies Windows processes whose command line contains both the SYSVOL path and the policies directory, indicating access to Group Policy content stored in SYSVOL. Attackers and administrators may interact with these locations to enumerate, modify, or stage policy-related files as part of broader domain abuse. The rule relies on process creation telemetry with access to the full command line string.
references:
- https://adsecurity.org/?p=2288
- https://www.hybrid-analysis.com/sample/f2943f5e45befa52fb12748ca7171d30096e1d4fc3c365561497c618341299d5?environmentId=100
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_sysvol_access.yml
author: Markus Neis, Jonhnathan Ribeiro, oscd.community, Huntrule Team
date: 2018-04-09
modified: 2022-01-07
tags:
- attack.credential-access
- attack.t1552.006
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains|all:
- \SYSVOL\
- \policies\
condition: selection
falsepositives:
- Administrative activity
level: medium
license: DRL-1.1
related:
- id: 05f3c945-dcc8-4393-9f3d-af65077a8f86
type: derived