T1552.006sub-technique of T1552 Unsecured Credentials

Group Policy Preferences

Windowsnothing on this site yetT1552.006 on attack.mitre.org

Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts. These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public).
MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

Checklists and playbooks to open while the alert is still live.

Playbook for this stage

Cloud account compromise

Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.

how MITRE says to see it

Detect Access and Decryption of Group Policy Preference (GPP) Credentials in SYSVOL

Correlates file enumeration of XML files in the SYSVOL share with suspicious process execution that decodes or reads encrypted credentials embedded in Group Policy Preference files (e.g., Get-GPPPassword.ps1, gpprefdecrypt.py, Metasploit).

what reduces it

M1047 Audit. Search SYSVOL for any existing GGPs that may contain credentials and remove them.
M1015 Active Directory Configuration. Remove vulnerable Group Policy Preferences.
M1051 Update Software. Apply patch KB2962486 which prevents credentials from being stored in GPPs.

the rest of T1552

T1552.001 Credentials In Files · 3 on this site
T1552.002 Credentials in Registry · not covered yet
T1552.003 Shell History · not covered yet
T1552.004 Private Keys · not covered yet
T1552.005 Cloud Instance Metadata API · not covered yet
T1552.007 Container API · not covered yet
T1552.008 Chat Messages · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.