Deceiving the Red Team with GPP

A common tactic used by pen testers, “red teams”, and threat actors is searching for Group Policy Preference (GPP) files with usernames and passwords.  These XML files, stored in the domain SYSVOL, are used to create local administrator accounts, map...