Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP).

Tactics
TA0006

Sub-technique of
T1552


See: MITRE ATT&CK