Cross-source coverage
T1069 / ATT&CK
Permission Groups Discovery
From MITRE ATT&CK 19.2
Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions.
Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.
- Tactics
- Discovery
- Platforms
- Containers · IaaS · Identity Provider · Linux · macOS · Office Suite · SaaS · Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:PowerShellauditd:SYSCALLmacos:unifiedlog
How MITRE says to detect it DET0179
Behavioral Detection of Permission Groups Discovery
Windows Analytic 0507
Detection of adversary enumeration of domain or local group memberships via native tools such as net.exe, PowerShell, or WMI. This activity may precede lateral movement or privilege escalation.
WinEventLog:SecurityEventCode=4688WinEventLog:PowerShellEventCode=4103, 4104, 4105, 4106
Linux Analytic 0508
Detection of group enumeration using commands like 'id', 'groups', or 'getent group', often followed by privilege escalation or SSH lateral movement.
auditd:SYSCALLexecve
macOS Analytic 0509
Group membership checks via 'dscl', 'dscacheutil', or 'id', typically executed via terminal or automation scripts.
macos:unifiedlogprocess:launch
Sub-techniques with coverage
Counted in the 116 above — a rule tagged a sub-technique covers this technique too.
splunk/security_content
32 rules| Detection | Severity | Format |
|---|---|---|
| ASL AWS IAM Successful Group Deletion | Undefined | SPL |
| AWS IAM Successful Group Deletion | Undefined | SPL |
| Detect AzureHound Command-Line Arguments | Undefined | SPL |
| Detect AzureHound File Modifications | Undefined | SPL |
| Detect SharpHound Command-Line Arguments | Undefined | SPL |
| Detect SharpHound File Modifications | Undefined | SPL |
| Detect SharpHound Usage | Undefined | SPL |
| Domain Group Discovery with Adsisearcher | Undefined | SPL |
| Domain Group Discovery With Dsquery | Undefined | SPL |
| Domain Group Discovery With Wmic | Undefined | SPL |
+ 22 more from splunk/security_content → showing the 10 highest-severity
SigmaHQ/sigma
26 rules| Detection | Severity | Format |
|---|---|---|
| BloodHound Collection Files | High | Sigma |
| HackTool - Bloodhound/Sharphound Execution | High | Sigma |
| HackTool - SharpView Execution | High | Sigma |
| Malicious PowerShell Commandlets - PoshModule | High | Sigma |
| Malicious PowerShell Commandlets - ProcessCreation | High | Sigma |
| Malicious PowerShell Commandlets - ScriptBlock | High | Sigma |
| PUA - AdFind Suspicious Execution | High | Sigma |
| Reconnaissance Activity | High | Sigma |
| Renamed AdFind Execution | High | Sigma |
| Suspicious Active Directory Database Snapshot Via ADExplorer | High | Sigma |
+ 16 more from SigmaHQ/sigma → showing the 10 highest-severity
elastic/detection-rules
24 rules| Detection | Severity | Format |
|---|---|---|
| Azure AD Graph Access with Suspicious User-Agent | High | Elastic TOML |
| Azure AD Graph Potential Enumeration (ROADrecon) | High | Elastic TOML |
| Entra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration | High | Elastic TOML |
| Entra ID Sign-in BloodHound Suite User-Agent Detected | High | Elastic TOML |
| Entra ID Sign-in TeamFiltration User-Agent Detected | High | Elastic TOML |
| AWS IAM Principal Enumeration via UpdateAssumeRolePolicy | Medium | Elastic TOML |
| Enumeration of Privileged Local Groups Membership | Medium | Elastic TOML |
| Kubectl Permission Discovery | Medium | Elastic TOML |
| Kubernetes Direct API Request via Curl or Wget | Medium | Elastic TOML |
| Potential Enumeration via Active Directory Web Service | Medium | Elastic TOML |
+ 14 more from elastic/detection-rules → showing the 10 highest-severity
socfortress/Wazuh-Rules
15 rules+ 5 more from socfortress/Wazuh-Rules → showing the 10 highest-severity
Bert-JanP/Hunting-Queries-Detection-Rules
8 rules · 7 families| Detection | Severity | Format |
|---|---|---|
| AzureHound Detection 2 variants | Undefined | KQL |
| AzureHound Detection 2 variants | Undefined | KQL |
| Cloud Discovery Performed by User At Risk | Undefined | KQL |
| Detect net(1).exe Discovery Activities | Undefined | KQL |
| List net(1).exe discovery activities | Undefined | KQL |
| Local Group Discovery | Undefined | KQL |
| MITRE ATT&CK Mapping | Undefined | KQL |
| Operation download all users in Azure Active directory performed | Undefined | KQL |
elastic/protections-artifacts
8 rules| Detection | Severity | Format |
|---|---|---|
| Active Directory Data Collection via LDAP | Undefined | Elastic TOML |
| AD Certificate Services Enumeration via LDAP | Undefined | Elastic TOML |
| Domain Trust and Schema Enumeration via LDAP | Undefined | Elastic TOML |
| Group and Privileged Accounts Discovery via LDAP | Undefined | Elastic TOML |
| Privileged Domain Group Enumeration via LDAP | Undefined | Elastic TOML |
| Suspicious Enumeration via LDAP Search | Undefined | Elastic TOML |
| User TCC DB Access by Osascript | Undefined | Elastic TOML |
| User TCC DB Access by Unsigned or Untrusted Process | Undefined | Elastic TOML |
Azure/Azure-Sentinel
1 rule| Detection | Severity | Format |
|---|---|---|
| Suspicious enumeration using Adfind tool (Normalized Process Events) | Undefined | KQL |
chronicle/detection-rules
1 rule| Detection | Severity | Format |
|---|---|---|
| recon_environment_enumeration_active_directory_cisa_report | Low | YARA-L |
panther-labs/panther-analysis
1 rule| Detection | Severity | Format |
|---|---|---|
| AWS IAM Group Read Only Events | Informational | Panther Python |