Group Policy Preferences (GPP) let administrators build domain policies with embedded credentials, for example to set local accounts. MITRE tracks the abuse of those stored credentials as T1552.006, a Windows credential access technique under Unsecured Credentials.
How attackers use it
GPP files are stored in SYSVOL on a domain controller. That means any domain user can view the SYSVOL share, and MITRE notes that the password can be decrypted with an AES key that has been made public. So a standard account can turn an old administrative convenience into working credentials.
MITRE says adversaries enumerate candidate XML files on the share, and that several well known tools and scripts exist to collect and decrypt the password files. The risk is not new, but old policies linger.
How to detect it
The detection strategy correlates two things: enumeration of XML files in SYSVOL, and a suspicious process that reads or decodes encrypted credentials from those files. Watch for abnormal access to the domain SYSVOL path combined with XML parsing or decryption logic.
How to reduce the risk
MITRE lists three steps.
- Active Directory configuration: remove vulnerable Group Policy Preferences.
- Audit: search SYSVOL for existing GPPs that may contain credentials and remove them. A search for the
cpasswordattribute in XML files under SYSVOL is the usual way to find them. - Update software: apply patch KB2962486, which prevents credentials from being stored in GPPs.
Removing the policy is not enough on its own. Any account whose password sat in a GPP should be treated as exposed and changed.
Quick check
Why can any domain user read a GPP password?
The files live in SYSVOL, which every domain user can read, and the AES key used to encrypt the password is public.
Sources
- MITRE ATT&CK, Unsecured Credentials: Group Policy Preferences: https://attack.mitre.org/techniques/T1552/006
