T1069 Permission Groups Discovery

discovery — Containers, IaaS, Identity Provider, Linux, macOS, Office Suite, SaaS, Windows · attack.mitre.org · JSON

MITRE detection strategy

analytics

Sigma rules tagged attack.t1069

KEV CVEs mapped here

<p>Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions.</p><p>Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

CVE	Vendor / product	Mapping type	State	Added
CVE-2021-44515	Zoho Desktop Central	secondary impact	Mapped	2021-12-10

Detection strategy · ATT&CK Enterprise v19.2

DET0179 Behavioral Detection of Permission Groups Discovery v1.0
AN0507 Windows
Detection of adversary enumeration of domain or local group memberships via native tools such as net.exe, PowerShell, or WMI. This activity may precede lateral movement or privilege escalation.

WinEventLog:Security EventCode=4688 → DC0032 Process Creation
WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106 → DC0064 Command Execution

Tunable: CommandLineRegex TimeWindow UserContext

AN0508 Linux
Detection of group enumeration using commands like 'id', 'groups', or 'getent group', often followed by privilege escalation or SSH lateral movement.

auditd:SYSCALL execve → DC0032 Process Creation

Tunable: CommandLine TTYSession

AN0509 macOS
Group membership checks via 'dscl', 'dscacheutil', or 'id', typically executed via terminal or automation scripts.

macos:unifiedlog process:launch → DC0032 Process Creation

Tunable: CommandLine ParentProcess

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1069`

Malicious PowerShell Commandlets - ProcessCreation hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-02 (modified 2025-12-10) · logsource: product=windows category=process_creation · 02030f2f-6199-49ec-b258-ea71b07e03dc

Detects Commandlet names from well-known PowerShell exploitation frameworks

Malicious PowerShell Commandlets - PoshModule hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-20 (modified 2025-12-10) · logsource: product=windows category=ps_module · 7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

Malicious PowerShell Commandlets - ScriptBlock hightest

Author: Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer · 2017-03-05 (modified 2025-12-10) · logsource: product=windows category=ps_script · 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

Sub-techniques

ID	Name	Sigma rules
T1069.001	Local Groups	16
T1069.002	Domain Groups	15
T1069.003	Cloud Groups	1

T1069 Permission Groups Discovery

KEV CVEs mapped to this technique · CTID Mappings Explorer

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1069

Sub-techniques

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1069`