Permission Groups Discovery

T1069

Technique with 3 sub-techniques.View on attack.mitre.org

About this technique

Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions.

Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.

Detection rules60

Rules on DetectionCode tagged with T1069 or one of its sub-techniques.

Sigma25

Rule	Level	Log source	Technique
BloodHound Collection Files	high	windows / file_event	T1069.001 T1069.002
HackTool - Bloodhound/Sharphound Execution	high	windows / process_creation	T1069.001 T1069.002
HackTool - SharpView Execution	high	windows / process_creation	T1069.002
Malicious PowerShell Commandlets - PoshModule	high	windows / ps_module	T1069 T1069.001 T1069.002
Malicious PowerShell Commandlets - ProcessCreation	high	windows / process_creation	T1069 T1069.001 T1069.002
Malicious PowerShell Commandlets - ScriptBlock	high	windows / ps_script	T1069 T1069.001 T1069.002
PUA - AdFind Suspicious Execution	high	windows / process_creation	T1069.002
Reconnaissance Activity	high	windows / NULL	T1069.002
Renamed AdFind Execution	high	windows / process_creation	T1069.002
Suspicious Active Directory Database Snapshot Via ADExplorer	high	windows / process_creation	T1069.002
Active Directory Database Snapshot Via ADExplorer	medium	windows / process_creation	T1069.002
ADExplorer Writing Complete AD Snapshot Into .dat File	medium	windows / file_event	T1069.002
Permission Check Via Accesschk.EXE	medium	windows / process_creation	T1069.001
Potential Active Directory Reconnaissance/Enumeration Via LDAP	medium	windows / NULL	T1069.002
Active Directory Group Enumeration With Get-AdGroup	low	windows / ps_script	T1069.002
AD Groups Or Users Enumeration Using PowerShell - PoshModule	low	windows / ps_module	T1069.001
AD Groups Or Users Enumeration Using PowerShell - ScriptBlock	low	windows / ps_script	T1069.001
Local Groups Discovery - Linux	low	linux / process_creation	T1069.001
Local Groups Reconnaissance Via Wmic.EXE	low	windows / process_creation	T1069.001
RBAC Permission Enumeration Attempt	low	kubernetes / application	T1069.003
Suspicious Get Information for SMB Share	low	windows / ps_script	T1069.001
Suspicious Get Information for SMB Share - PowerShell Module	low	windows / ps_module	T1069.001
Suspicious Get Local Groups Information	low	windows / ps_module	T1069.001
Suspicious Get Local Groups Information - PowerShell	low	windows / ps_script	T1069.001
Local Groups Discovery - MacOs	informational	macos / process_creation	T1069.001

Splunk35

Rule	Type	Risk	Data source	Technique
ASL AWS IAM Successful Group Deletion	Hunting	NULL	ASL AWS CloudTrail	T1069.003
AWS IAM Successful Group Deletion	Hunting	NULL	AWS CloudTrail DeleteGroup	T1069.003
Detect AzureHound Command-Line Arguments	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1069.001 T1069.002
Detect AzureHound File Modifications	TTP	NULL	Sysmon EventID 11	T1069.001 T1069.002
Detect SharpHound Command-Line Arguments	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1069.001 T1069.002
Detect SharpHound File Modifications	TTP	NULL	Sysmon EventID 11	T1069.001 T1069.002
Detect SharpHound Usage	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1069.001 T1069.002
Domain Group Discovery with Adsisearcher	TTP	NULL	Powershell Script Block Logging 4104	T1069.002
Domain Group Discovery With Dsquery	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1069.002
Domain Group Discovery With Net	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1069.002
Domain Group Discovery With Wmic	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1069.002
Elevated Group Discovery With Net	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1069.002
Elevated Group Discovery with PowerView	Hunting	NULL	Powershell Script Block Logging 4104	T1069.002
Elevated Group Discovery With Wmic	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1069.002
Get WMIObject Group Discovery	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1069.001
Get WMIObject Group Discovery with Script Block Logging	Hunting	NULL	Powershell Script Block Logging 4104	T1069.001
GetAdGroup with PowerShell	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1069.002
GetAdGroup with PowerShell Script Block	Hunting	NULL	Powershell Script Block Logging 4104	T1069.002
GetDomainGroup with PowerShell	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1069.002
GetDomainGroup with PowerShell Script Block	TTP	NULL	Powershell Script Block Logging 4104	T1069.002
GetWmiObject Ds Group with PowerShell	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1069.002
GetWmiObject Ds Group with PowerShell Script Block	TTP	NULL	Powershell Script Block Logging 4104	T1069.002
Net Localgroup Discovery	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1069.001
Network Traffic to Active Directory Web Services Protocol	Hunting	NULL	Sysmon EventID 3	T1069.001 T1069.002
PowerShell Get LocalGroup Discovery	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1069.001
Powershell Get LocalGroup Discovery with Script Block Logging	Hunting	NULL	Powershell Script Block Logging 4104	T1069.001
Windows Admin Permission Discovery	Anomaly	NULL	Sysmon EventID 11	T1069.001
Windows Azure PowerShell Module Installation Via PowerShell Script	Anomaly	NULL	Powershell Script Block Logging 4104	T1069.003
Windows Group Discovery Via Net	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1069.001 T1069.002
Windows Ldifde Directory Object Behavior	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1069.002
Windows Post Exploitation Risk Behavior	Correlation	NULL		T1069
Windows PowerView AD Access Control List Enumeration	TTP	NULL	Powershell Script Block Logging 4104	T1069
Windows Sensitive Group Discovery With Net	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1069.002
Windows SOAPHound Binary Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1069.001 T1069.002
Wmic Group Discovery	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1069.001

Sub-techniques3

ID	Name	Examples
T1069.001	Local Groups	32
T1069.002	Domain Groups	38
T1069.003	Cloud Groups	5

Groups6

Software6

Carbon IcedID MURKYTOP ShimRatReporter Siloscape TrickBot

Campaigns1

SolarWinds Compromise

Procedure examples13

Groups6

Used by	Procedure example
GroupAPT3	APT3 has a tool that can enumerate the permissions associated with Windows groups. Symantec Buckeye
GroupAPT41	APT41 used `net group` commands to enumerate various Windows user groups and permissions. Rostovcev APT41 2021
GroupFIN13	FIN13 has enumerated all users and roles from a victim's main treasury system. Mandiant FIN13 Aug 2022
GroupScattered Spider	Scattered Spider has enumerated the vSphere Admins and ESX Admins groups in targeted environments. Mandiant VMware vSphere JUL 2025
GroupTA505	TA505 has used TinyMet to enumerate members of privileged groups. TA505 has also run `net group /domain`. IBM TA505 April 2020 Trend Micro TA505 June 2019
GroupVolt Typhoon	Volt Typhoon has used commercial tools, LOTL utilities, and appliances already present on the system for group and user discovery. CISA AA24-038A PRC Critical Infrastructure February 2024

Software6

Used by	Procedure example
MalwareCarbon	Carbon uses the `net group` command. GovCERT Carbon May 2016
MalwareIcedID	IcedID has the ability to identify Workgroup membership. IBM IcedID November 2017
MalwareMURKYTOP	MURKYTOP has the capability to retrieve information about groups. FireEye Periscope March 2018
ToolShimRatReporter	ShimRatReporter gathered the local privileges for the infected host. FOX-IT May 2016 Mofang
MalwareSiloscape	Siloscape checks for Kubernetes node permissions. Unit 42 Siloscape Jun 2021
MalwareTrickBot	TrickBot can identify the groups the user on a compromised host belongs to. Cyberreason Anchor December 2019

Campaigns1

Used by	Procedure example
CampaignSolarWinds Compromise	During the SolarWinds Compromise, APT29 used the `Get-ManagementRoleAssignment` PowerShell cmdlet to enumerate Exchange management role assignments through an Exchange Management Shell. Volexity SolarWinds

References1

CrowdStrike BloodHound April 2018 Open source
Red Team Labs. (2018, April 24). Hidden Administrative Accounts: BloodHound to the Rescue. Retrieved October 28, 2020.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.