T1069.002 Domain Groups
Sub-technique of T1069 Permission Groups Discovery
Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators. Commands such as net group /domain of the…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- BloodHound Collection Fileshightest · windows
- HackTool - Bloodhound/Sharphound Executionhightest · windows
- HackTool - SharpView Executionhightest · windows
- Malicious PowerShell Commandlets - PoshModulehightest · windows
- Malicious PowerShell Commandlets - ProcessCreationhightest · windows
- Malicious PowerShell Commandlets - ScriptBlockhightest · windows
- PUA - AdFind Suspicious Executionhightest · windows
- Reconnaissance Activityhightest · windows
- Renamed AdFind Executionhightest · windows
- Suspicious Active Directory Database Snapshot Via ADExplorerhightest · windows
- Active Directory Database Snapshot Via ADExplorermediumtest · windows
- Potential Active Directory Reconnaissance/Enumeration Via LDAPmediumtest · windows
- ADExplorer Writing Complete AD Snapshot Into .dat Filemediumexperimental · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.