T1069.002 Domain Groups

discovery — Linux, macOS, Windows · attack.mitre.org · JSON

MITRE detection strategy

analytics

Sigma rules tagged attack.t1069.002

KEV CVEs mapped here

<p>Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.</p><p>Commands such as <code>net group /domain</code> of the Net utility, <code>dscacheutil -q group</code> on macOS, and <code>ldapsearch</code> on Linux can list domain-level groups.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

DET0360 Behavioral Detection of Domain Group Discovery v1.0
AN1025 Windows
Detection of domain group enumeration through command-line utilities such as 'net group /domain' or PowerShell cmdlets, followed by suspicious access to API calls or LSASS memory.

WinEventLog:Security EventCode=4688 → DC0032 Process Creation
WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106 → DC0064 Command Execution

Tunable: TimeWindow UserContext ProcessLineageDepth

AN1026 Linux
Behavioral detection of domain group enumeration via ldapsearch or custom scripts leveraging LDAP over the network.

auditd:SYSCALL execve → DC0032 Process Creation
linux:syslog sshd logs → DC0064 Command Execution
NSM:Flow ldap.log → DC0085 Network Traffic Content

Tunable: LDAPQueryDepth CommandPattern

AN1027 macOS
Enumeration of domain groups using dscacheutil or dscl commands, often following initial login or domain trust queries.

macos:unifiedlog process events → DC0032 Process Creation

Tunable: CommandSignatureThreshold TimeWindow

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1069.002`

Malicious PowerShell Commandlets - ProcessCreation hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-02 (modified 2025-12-10) · logsource: product=windows category=process_creation · 02030f2f-6199-49ec-b258-ea71b07e03dc

Detects Commandlet names from well-known PowerShell exploitation frameworks

BloodHound Collection Files hightest

Author: C.J. May · 2022-08-09 (modified 2026-02-19) · logsource: product=windows category=file_event · 02773bed-83bf-469f-b7ff-e676e7d78bab

Detects default file names outputted by the BloodHound collection tool SharpHound

Techniques: T1087.001 T1087.002 T1482 T1069.001 T1069.002 T1059.001

ADExplorer Writing Complete AD Snapshot Into .dat File mediumexperimental

Author: Arnim Rupp (Nextron Systems), Thomas Patzke · 2025-07-09 · logsource: product=windows category=file_event · 0a1255c5-d732-4b62-ac02-b5152d34fb83

Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.

Techniques: T1087.002 T1069.002 T1482

Net.EXE Execution lowtest

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements) · 2019-01-16 (modified 2022-07-11) · logsource: product=windows category=process_creation · 183e7ea8-ac4b-4c23-9aec-b3dac4e401ac

Detects execution of "Net.EXE".

Techniques: T1007 T1049 T1018 T1135 T1201 T1069.001 T1069.002 T1087.001 T1087.002 T1021.002

Potential Active Directory Reconnaissance/Enumeration Via LDAP mediumtest

Author: Adeem Mawani · 2021-06-22 (modified 2025-07-04) · logsource: product=windows service=ldap · 31d68132-4038-47c7-8f8e-635a39a7c174

Detects potential Active Directory enumeration via LDAP

Techniques: T1069.002 T1087.002 T1482

Malicious PowerShell Commandlets - PoshModule hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-20 (modified 2025-12-10) · logsource: product=windows category=ps_module · 7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

Malicious PowerShell Commandlets - ScriptBlock hightest

Author: Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer · 2017-03-05 (modified 2025-12-10) · logsource: product=windows category=ps_script · 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

Active Directory Group Enumeration With Get-AdGroup lowtest

Author: frack113 · 2022-03-17 (modified 2022-11-17) · logsource: product=windows category=ps_script · 8c3a6607-b7dc-4f0d-a646-ef38c00b76ee

Detects usage of the "Get-AdGroup" cmdlet to enumerate Groups within Active Directory

Techniques: T1069.002

Active Directory Database Snapshot Via ADExplorer mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-03-14 (modified 2025-07-09) · logsource: product=windows category=process_creation · 9212f354-7775-4e28-9c9f-8f0a4544e664

Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.

Techniques: T1087.002 T1069.002 T1482

Reconnaissance Activity hightest

Author: Florian Roth (Nextron Systems), Jack Croock (method), Jonhnathan Ribeiro (improvements), oscd.community · 2017-03-07 (modified 2022-08-22) · logsource: product=windows service=security · 968eef52-9cff-4454-8992-1e74b9cbad6c

Detects activity as "net user administrator /domain" and "net group domain admins /domain"

Techniques: T1087.002 T1069.002

PUA - AdFind Suspicious Execution hightest

Author: Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community · 2021-02-02 (modified 2025-10-24) · logsource: product=windows category=process_creation · 9a132afa-654e-11eb-ae93-0242ac130002

Detects AdFind execution with common flags seen used during attacks

Techniques: T1018 T1087.002 T1482 T1069.002

HackTool - SharpView Execution hightest

Author: frack113 · 2021-12-10 (modified 2023-02-14) · logsource: product=windows category=process_creation · b2317cfa-4a47-4ead-b3ff-297438c0bc2d

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Techniques: T1049 T1069.002 T1482 T1135 T1033

Renamed AdFind Execution hightest

Author: Florian Roth (Nextron Systems) · 2022-08-21 (modified 2025-02-26) · logsource: product=windows category=process_creation · df55196f-f105-44d3-a675-e9dfb6cc2f2b

Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.

Techniques: T1018 T1087.002 T1482 T1069.002

Suspicious Active Directory Database Snapshot Via ADExplorer hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-03-14 (modified 2025-07-09) · logsource: product=windows category=process_creation · ef61af62-bc74-4f58-b49b-626448227652

Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database to a suspicious directory. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.

Techniques: T1087.002 T1069.002 T1482

HackTool - Bloodhound/Sharphound Execution hightest

Author: Florian Roth (Nextron Systems) · 2019-12-20 (modified 2023-02-04) · logsource: product=windows category=process_creation · f376c8a7-a2d0-4ddc-aa0c-16c17236d962

Detects command line parameters used by Bloodhound and Sharphound hack tools

Techniques: T1087.001 T1087.002 T1482 T1069.001 T1069.002 T1059.001

Rules tagged at the parent level (attack.t1069) 3

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

Malicious PowerShell Commandlets - ProcessCreation hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-02 (modified 2025-12-10) · logsource: product=windows category=process_creation · 02030f2f-6199-49ec-b258-ea71b07e03dc

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

Malicious PowerShell Commandlets - PoshModule hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-20 (modified 2025-12-10) · logsource: product=windows category=ps_module · 7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

Malicious PowerShell Commandlets - ScriptBlock hightest

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

T1069.002 Domain Groups

KEV CVEs mapped to this technique · CTID Mappings Explorer

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1069.002

Rules tagged at the parent level (attack.t1069) 3

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1069.002`