- Tactics
- Discovery
- Platforms
- Linux, macOS, Windows
- Reference
- attack.mitre.org/techniques/T1069.002
Description
Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.
Commands such as net group /domain of the Net utility, dscacheutil -q group on macOS, and ldapsearch on Linux can list domain-level groups.
How GTK Cyber trains on this
GTK Cyber's Threat Hunting with Data Science course teaches you to build machine-learning detections for techniques like this across the MITRE ATT&CK framework, including the Discovery tactic this technique falls under. Practitioner-led, focused on real detections, not memorizing technique IDs.
Related techniques
- T1007 - System Service Discovery
- T1010 - Application Window Discovery
- T1012 - Query Registry
- T1016 - System Network Configuration Discovery
- T1018 - Remote System Discovery
- T1033 - System Owner/User Discovery
- T1040 - Network Sniffing
- T1046 - Network Service Discovery
- T1049 - System Network Connections Discovery
- T1057 - Process Discovery
- T1069 - Permission Groups Discovery
- T1082 - System Information Discovery