MITRE ATT&CK technique

Permission Groups Discovery detection rulesT1069

Permission Groups Discovery (T1069) is a MITRE ATT&CK technique in the Discovery tactic. This page lists the 26 community-maintained Sigma detection rules in the library mapped to T1069 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows, linux, kubernetes.

T1069 on attack.mitre.org26 rules

Tactic

Discovery

BloodHound Collection Files
high
Detects default file names outputted by the BloodHound collection tool SharpHound
windows · file_event
HackTool - Bloodhound/Sharphound Execution
high
Detects command line parameters used by Bloodhound and Sharphound hack tools
windows · process_creation
HackTool - SharpView Execution
high
Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
windows · process_creation
Malicious PowerShell Commandlets - PoshModule
high
Detects Commandlet names from well-known PowerShell exploitation frameworks
windows · ps_module
Malicious PowerShell Commandlets - ProcessCreation
high
Detects Commandlet names from well-known PowerShell exploitation frameworks
windows · process_creation
Malicious PowerShell Commandlets - ScriptBlock
high
Detects Commandlet names from well-known PowerShell exploitation frameworks
windows · ps_script
PUA - AdFind Suspicious Execution
high
Detects AdFind execution with common flags seen used during attacks
windows · process_creation
Reconnaissance Activity
high
Detects activity as "net user administrator /domain" and "net group domain admins /domain"
windows
Renamed AdFind Execution
high
Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.
windows · process_creation
Suspicious Active Directory Database Snapshot Via ADExplorer
high
Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database to a suspicious directory. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.
windows · process_creation
Active Directory Database Snapshot Via ADExplorer
medium
Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.
windows · process_creation
ADExplorer Writing Complete AD Snapshot Into .dat File
medium
Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.
windows · file_event
Permission Check Via Accesschk.EXE
medium
Detects the usage of the "Accesschk" utility, an access and privilege audit tool developed by SysInternal and often being abused by attacker to verify process privileges
windows · process_creation
Potential Active Directory Reconnaissance/Enumeration Via LDAP
medium
Detects potential Active Directory enumeration via LDAP
windows
Active Directory Group Enumeration With Get-AdGroup
low
Detects usage of the "Get-AdGroup" cmdlet to enumerate Groups within Active Directory
windows · ps_script
AD Groups Or Users Enumeration Using PowerShell - PoshModule
low
Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.
windows · ps_module
AD Groups Or Users Enumeration Using PowerShell - ScriptBlock
low
Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.
windows · ps_script
Local Groups Discovery - Linux
low
Detects enumeration of local system groups. Adversaries may attempt to find local system groups and permission settings
linux · process_creation
Local Groups Reconnaissance Via Wmic.EXE
low
Detects the execution of "wmic" with the "group" flag. Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.
windows · process_creation
Net.EXE Execution
low
Detects execution of "Net.EXE".
windows · process_creation
RBAC Permission Enumeration Attempt
low
Detects identities attempting to enumerate their Kubernetes RBAC permissions. In the early stages of a breach, attackers will aim to list the permissions they have within the compromised environment. In a Kubernetes cluster, this can be achieved by interacting with the API server, and querying the SelfSubjectAccessReview API via e.g. a "kubectl auth can-i --list" command. This will enumerate the Role-Based Access Controls (RBAC) rules defining the compromised user's authorization.
kubernetes · application
Suspicious Get Information for SMB Share
low
Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
windows · ps_script
Suspicious Get Information for SMB Share - PowerShell Module
low
Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
windows · ps_module
Suspicious Get Local Groups Information
low
Detects the use of PowerShell modules and cmdlets to gather local group information. Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group.
windows · ps_module
Suspicious Get Local Groups Information - PowerShell
low
Detects the use of PowerShell modules and cmdlets to gather local group information. Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group.
windows · ps_script
Local Groups Discovery - MacOs
informational
Detects enumeration of local system groups
macos · process_creation

Top products

Tactic

BloodHound Collection Files

HackTool - Bloodhound/Sharphound Execution

HackTool - SharpView Execution

Malicious PowerShell Commandlets - PoshModule

Malicious PowerShell Commandlets - ProcessCreation

Malicious PowerShell Commandlets - ScriptBlock

PUA - AdFind Suspicious Execution

Reconnaissance Activity

Renamed AdFind Execution

Suspicious Active Directory Database Snapshot Via ADExplorer

Active Directory Database Snapshot Via ADExplorer

ADExplorer Writing Complete AD Snapshot Into .dat File

Permission Check Via Accesschk.EXE

Potential Active Directory Reconnaissance/Enumeration Via LDAP

Active Directory Group Enumeration With Get-AdGroup

AD Groups Or Users Enumeration Using PowerShell - PoshModule

AD Groups Or Users Enumeration Using PowerShell - ScriptBlock

Local Groups Discovery - Linux

Local Groups Reconnaissance Via Wmic.EXE

Net.EXE Execution

RBAC Permission Enumeration Attempt

Suspicious Get Information for SMB Share

Suspicious Get Information for SMB Share - PowerShell Module

Suspicious Get Local Groups Information

Suspicious Get Local Groups Information - PowerShell

Local Groups Discovery - MacOs