Permission Groups Discovery
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
Every command the brief names belongs to a child, and the two things MITRE says would make it parent-level are not expressible in the Sigma subset this corpus models. AN0507 (Windows, process_creation + windows/powershell) puts 'net group' and 'Get-ADGroupMember' in its CommandLineRegex knob — both read domain groups, which is T1069.002 — while the same binaries' local forms, 'net localgroup' and Get-LocalGroupMember, are T1069.001; nothing in the analytic separates the two at the parent, so a rule ORing them together would be two children's detections filed under the parent tag, the mislabelling AUTHORING.md rule 3 exists to prevent. AN0508 (Linux, process_creation) names 'id', 'groups' and 'getent group', which read /etc/group and the local NSS databases: T1069.001. AN0509 (macOS, macos/unifiedlog) names 'dscl. […]
What the technique is
Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions. Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0507
Detection of adversary enumeration of domain or local group memberships via native tools such as net.exe, PowerShell, or WMI. This activity may precede lateral movement or privilege escalation.
- AN0508
Detection of group enumeration using commands like 'id', 'groups', or 'getent group', often followed by privilege escalation or SSH lateral movement.
- AN0509
Group membership checks via 'dscl', 'dscacheutil', or 'id', typically executed via terminal or automation scripts.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.