Cross-source coverage

T1069.002 / ATT&CK

Permission Groups Discovery: Domain Groups

51 rules across 6 sources.

From MITRE ATT&CK 19.2

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.

Commands such as net group /domain of the Net utility, dscacheutil -q group on macOS, and ldapsearch on Linux can list domain-level groups.

Tactics: Discovery
Platforms: Linux · macOS · Windows
Telemetry: WinEventLog:SecurityWinEventLog:PowerShellauditd:SYSCALLlinux:syslogNSM:Flowmacos:unifiedlog

How MITRE says to detect it DET0360

Behavioral Detection of Domain Group Discovery

Windows Analytic 1025

Detection of domain group enumeration through command-line utilities such as 'net group /domain' or PowerShell cmdlets, followed by suspicious access to API calls or LSASS memory.

WinEventLog:Security EventCode=4688
WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106

Linux Analytic 1026

Behavioral detection of domain group enumeration via ldapsearch or custom scripts leveraging LDAP over the network.

auditd:SYSCALL execve
linux:syslog sshd logs
NSM:Flow ldap.log

macOS Analytic 1027

Enumeration of domain groups using dscacheutil or dscl commands, often following initial login or domain trust queries.

macos:unifiedlog process events

View on attack.mitre.org ↗

splunk/security_content

21 rules

Detection	Severity	Format
Detect AzureHound Command-Line Arguments	Undefined	SPL
Detect AzureHound File Modifications	Undefined	SPL
Detect SharpHound Command-Line Arguments	Undefined	SPL
Detect SharpHound File Modifications	Undefined	SPL
Detect SharpHound Usage	Undefined	SPL
Domain Group Discovery with Adsisearcher	Undefined	SPL
Domain Group Discovery With Dsquery	Undefined	SPL
Domain Group Discovery With Wmic	Undefined	SPL
Elevated Group Discovery with PowerView	Undefined	SPL
Elevated Group Discovery With Wmic	Undefined	SPL

+ 11 more from splunk/security_content → showing the 10 highest-severity

SigmaHQ/sigma

15 rules

Detection	Severity	Format
BloodHound Collection Files	High	Sigma
HackTool - Bloodhound/Sharphound Execution	High	Sigma
HackTool - SharpView Execution	High	Sigma
Malicious PowerShell Commandlets - PoshModule	High	Sigma
Malicious PowerShell Commandlets - ProcessCreation	High	Sigma
Malicious PowerShell Commandlets - ScriptBlock	High	Sigma
PUA - AdFind Suspicious Execution	High	Sigma
Reconnaissance Activity	High	Sigma
Renamed AdFind Execution	High	Sigma
Suspicious Active Directory Database Snapshot Via ADExplorer	High	Sigma

+ 5 more from SigmaHQ/sigma → showing the 10 highest-severity

elastic/detection-rules

7 rules

Detection	Severity	Format
Potential Enumeration via Active Directory Web Service	Medium	Elastic TOML
Active Directory Discovery using AdExplorer	Low	Elastic TOML
AdFind Command Activity	Low	Elastic TOML
Enumeration of Administrator Accounts	Low	Elastic TOML
Enumeration of Users or Groups via Built-in Commands	Low	Elastic TOML
PowerShell Suspicious Discovery Related Windows API Functions	Low	Elastic TOML
Suspicious Access to LDAP Attributes	Low	Elastic TOML

elastic/protections-artifacts

6 rules

Detection	Severity	Format
Active Directory Data Collection via LDAP	Undefined	Elastic TOML
AD Certificate Services Enumeration via LDAP	Undefined	Elastic TOML
Domain Trust and Schema Enumeration via LDAP	Undefined	Elastic TOML
Group and Privileged Accounts Discovery via LDAP	Undefined	Elastic TOML
Privileged Domain Group Enumeration via LDAP	Undefined	Elastic TOML
Suspicious Enumeration via LDAP Search	Undefined	Elastic TOML

chronicle/detection-rules

1 rule

Detection	Severity	Format
recon_environment_enumeration_active_directory_cisa_report	Low	YARA-L

socfortress/Wazuh-Rules

1 rule

Detection	Severity	Format
LDAPSearch execution detected - Possible domain enumeration (T1069.002)	Medium	Wazuh XML