Procedure examples

Flagpro has been used to execute the net localgroup administrators command on a targeted system.

Exbyte checks whether the process is running with privileged local access during execution.

Epic gathers information on local group names.

Caterpillar WebShell can obtain a list of local groups of users from a system.

Sys10 collects the group name of the logged-in user and sends it to the C2.

Cobalt Strike can use net localgroup to list local groups on a system.

Kwampirs collects a list of users belonging to the local users and administrators groups with the commands net localgroup administrators and net localgroup users.

JPIN can obtain the permissions of the victim user.

LunarWeb can discover local group memberships.

QakBot can use net localgroup to enable discovery of local groups.

Helminth has checked the local administrators group.

OSInfo has enumerated the local administrators group.

Commands such as net group and net localgroup can be used in Net to gather information about and manipulate groups.

BloodHound can collect information about local groups and members.

SILENTTRINITY can obtain a list of local groups and members.

PoshC2 contains modules, such as Get-LocAdm for enumerating permission groups.

During C0015, the threat actors use the command `net group "domain admins" /dom` to enumerate domain groups.

During the SolarWinds Compromise, APT29 used AdFind to enumerate domain groups.

Volt Typhoon has run `net group` in compromised environments to discover domain groups.

Dragonfly has used batch scripts to enumerate administrators and users in the domain.

FIN7 has used the command `net group "domain admins" /domain` to enumerate domain groups.

Mustang Panda has leveraged AdFind to enumerate domain groups.

Scattered Spider has enumerated Active Directory security groups including through the use of ADExplorer, ADRecon.ps1, and Get-ADUser.

OilRig has used net group /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to find domain group permission settings.

Ke3chang performs discovery of permission groups net group /domain.

Turla has used net group "Domain Admins" /domain to identify domain administrators.

Medusa Group has utilized the `net group` command to query domain groups within the victim environment.

ToddyCat has executed `net group "domain admins" /dom` for discovery on compromised machines.

INC Ransom has enumerated domain groups on targeted hosts.

LAPSUS$ has used the AD Explorer tool to enumerate groups on a victim's network.

Inception has used specific malware modules to gather domain membership.

GRIFFON has used a reconnaissance module that can be used to retrieve Windows domain membership information.

POWRUNER may collect domain group information by running net group /domain or a series of other commands on a victim.

BADHATCH can use `net.exe group "domain admins" /domain` to identify Domain Administrators.

Gootloader can determine if a targeted system is part of an Active Directory domain by expanding the %USERDNSDOMAIN% environment variable.

WellMess can identify domain group membership for the current user.

BlackCat can determine if a user on a compromised host has domain admin privileges.

Latrodectus can identify domain groups through `cmd.exe /c net group "Domain Admins" /domain`.

Cobalt Strike can identify targets by querying account groups on a domain contoller.

REvil can identify the domain membership of a compromised host.

Kwampirs collects a list of domain groups with the command net localgroup /domain.

LAMEHUG can use dsquery to gather domain group information.

Egregor can conduct Active Directory reconnaissance using tools such as Sharphound or AdFind.

Qilin can run PowerShell cmdlets to discover domain groups.

SoreFang can enumerate domain groups by executing net.exe group /domain.

Helminth has checked for the domain admin group and Exchange Trusted Subsystem groups using the commands net group Exchange Trusted Subsystem /domain and net group domain admins /domain.

OSInfo specifically looks for Domain Admins and power users within the domain.

Commands such as net group /domain can be used in Net to gather information about and manipulate groups.

BloodHound can collect information about domain groups and members.

SILENTTRINITY can use `System.DirectoryServices` namespace to retrieve domain group information.