Enumerating remote access policies through GPO
Tags
attack-pattern: Credentials - T1589.001 Dns - T1071.004 Dns - T1590.002 Powershell - T1059.001 Remote Desktop Protocol - T1021.001 Server - T1583.004 Server - T1584.004 Software - T1592.002 Powershell - T1086 Remote Desktop Protocol - T1076
Show in Graph
Common Information
Type Value
UUID a3eb40b1-4fc6-4ca0-bac4-b44d8da22215
Fingerprint 9028c19268b09540
Analysis status DONE
Considered CTI value 0
Text language
Published Jan. 30, 2018, midnight
Added to db Jan. 18, 2023, 9:56 p.m.
Last updated Nov. 17, 2024, 11:40 p.m.
Headline Enumerating remote access policies through GPO
Title Enumerating remote access policies through GPO
Detected Hints/Tags/Attributes 44/1/12
Source URLs
Redirection Url
Details Source https://labs.mwrinfosecurity.com/blog/enumerating-remote-access-policies-through-gpo/
URL Provider
Details Provider Source level domain
Details mwrinfosecurity.com labs.mwrinfosecurity.com
Attributes
Details Type #Events CTI Value
Details Domain 4128 
github.com
Details Domain 1 
remoteaccesspolicies.psobject.properties
Details File 1 
powerview-with-remoteaccesspolicyenumeration.ps1
Details File 2 
gpttmpl.inf
Details File 4 
registry.xml
Details File 1 
inf.psb
Details File 1 
ase.key
Details File 1 
remoteaccesspolicies.ps
Details Github username 5 
mwrlabs
Details Microsoft Patch Numbers 18 
KB2871997
Details Url 1 
https://github.com/mwrlabs/gists/blob/master/powerview-with-remoteaccesspolicyenumeration.ps1
Details Windows Registry Key 17 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System