T1069 Permission Groups Discovery
Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions. Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- BloodHound Collection Fileshightest · windows
- HackTool - Bloodhound/Sharphound Executionhightest · windows
- HackTool - SharpView Executionhightest · windows
- Malicious PowerShell Commandlets - PoshModulehightest · windows
- Malicious PowerShell Commandlets - ProcessCreationhightest · windows
- Malicious PowerShell Commandlets - ScriptBlockhightest · windows
- PUA - AdFind Suspicious Executionhightest · windows
- Reconnaissance Activityhightest · windows
- Renamed AdFind Executionhightest · windows
- Suspicious Active Directory Database Snapshot Via ADExplorerhightest · windows
- Active Directory Database Snapshot Via ADExplorermediumtest · windows
- Permission Check Via Accesschk.EXEmediumtest · windows
- Potential Active Directory Reconnaissance/Enumeration Via LDAPmediumtest · windows
- ADExplorer Writing Complete AD Snapshot Into .dat Filemediumexperimental · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.