T1069 Permission Groups Discovery
Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions. Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- BloodHound Collection Fileshightest · windows
- HackTool - Bloodhound/Sharphound Executionhightest · windows
- HackTool - SharpView Executionhightest · windows
- Malicious PowerShell Commandlets - PoshModulehightest · windows
- Malicious PowerShell Commandlets - ProcessCreationhightest · windows
- Malicious PowerShell Commandlets - ScriptBlockhightest · windows
- PUA - AdFind Suspicious Executionhightest · windows
- Reconnaissance Activityhightest · windows
- Renamed AdFind Executionhightest · windows
- Suspicious Active Directory Database Snapshot Via ADExplorerhightest · windows
- Active Directory Database Snapshot Via ADExplorermediumtest · windows
- Permission Check Via Accesschk.EXEmediumtest · windows
- Potential Active Directory Reconnaissance/Enumeration Via LDAPmediumtest · windows
- ADExplorer Writing Complete AD Snapshot Into .dat Filemediumexperimental · windows
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.