New Check: Potentially malicious gPCFileSysPath

Products PingCastle Ideas
,
1

What is a one sentence summary of your feature request?

Uncover odd looking gPCFileSysPath paths that may indicate malicious behavior

Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.

The gPCFileSysPath will force a user / computer to reach out to the file path specified. It could be common for the attack tools to directly revert this but this could have been manually modified or odd/historic scenarios uncovered.

Checks
Does gPCFileSysPath resolve to a Domain Controller? - It should
Does gPCFileSysPath include IP Address? (NTLM Downgrade / potentially malicious )

Documentation Links

How do you currently solve the challenges you have by not having this feature?

Using other tools such as PowerShell

2

Thanks for the detection rule idea here Brandon. This is definitely something that we should be able to get easily even if it is unlikely to trigger due to many of the tools that do this automatically cleaning themselves up.