tfMITRE ATT&CK technique

Permission Groups Discovery T1069

Tactic: Discovery
Platforms: Containers, IaaS, Identity Provider, Linux, macOS, Office Suite, SaaS, Windows
Version: 2.6
Created: 31 May 2017
Last modified: 24 October 2025
Contributors: Daniel Prizmant, Palo Alto Networks; Yuval Avrahami, Palo Alto Networks; Microsoft Threat Intelligence Center (MSTIC)

Sub-techniques 358 rules across the family · 5 mapped directly to T1069 · 3 of 3 carry rules

.001Local Groups30 .002Domain Groups36 .003Cloud Groups4

Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 25%

Threat groups75th percentile · 75% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware68th pct

Tools & malware68th percentile · 68% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules64th pct

Detection rules64th percentile · 64% of ATT&CK techniques have this many detection rules written or fewer.

Permission Groups Discovery MITRE reference T1069

Top 25%of all ATT&CK techniques for number of groups

6 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Volt TyphoonG1017 ↗

Has used commercial tools, LOTL utilities, and appliances already present on the system for group and user discovery.1

created 2023-07-271 referenceaka BRONZE SILHOUETTE

FIN13G1016 ↗

Has enumerated all users and roles from a victim's main treasury system.1

created 2023-07-271 referenceaka Elephant Beetle

Scattered SpiderG1015 ↗

Has enumerated the vSphere Admins and ESX Admins groups in targeted environments.1

created 2023-07-051 referenceaka Roasted 0ktapus

APT41G0096 ↗

Used net group commands to enumerate various Windows user groups and permissions.1

created 2019-09-231 referenceaka Wicked Panda

TA505G0092 ↗

Has used TinyMet to enumerate members of privileged groups.1 TA505 has also run net group /domain.2

created 2019-05-282 referencesaka Hive0065

APT3G0022 ↗

Has a tool that can enumerate the permissions associated with Windows groups.1

created 2017-05-311 referenceaka Gothic Panda

All 6 groups for this technique

1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

SolarWinds CompromiseC0024 ↗

During the SolarWinds Compromise, APT29 used the Get-ManagementRoleAssignment PowerShell cmdlet to enumerate Exchange management role assignments through an Exchange Management Shell.1

2019–2021

All 1 campaigns for this technique

6 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

SiloscapeS0623 ↗

Checks for Kubernetes node permissions.1

created 2021-06-18MALWARE

IcedIDS0483 ↗

Has the ability to identify Workgroup membership.1

created 2020-07-15MALWAREcarried by 2 groups

ShimRatReporterS0445 ↗

Gathered the local privileges for the infected host.1

created 2020-05-12TOOLcarried by 1 group

CarbonS0335 ↗

Uses the net group command.1

created 2019-01-29MALWAREcarried by 1 group

TrickBotS0266 ↗

Can identify the groups the user on a compromised host belongs to.1

created 2018-10-17MALWAREcarried by 2 groups

MURKYTOPS0233 ↗

Has the capability to retrieve information about groups.1

created 2018-04-18MALWAREcarried by 1 group

All 6 software entries for this technique

Offense vs defense T1069

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 2

first rule: 2017 Q1 · 1 of 1 campaigns plotted

Permission Groups Discovery detection strategy DET0179

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavioral Detection of Permission Groups Discovery

Enterprise

3 platforms

AN0507 · Windows

Detection of adversary enumeration of domain or local group memberships via native tools such as net.exe, PowerShell, or WMI. This activity may precede lateral movement or privilege escalation.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandLineRegex	Regex filters for matching suspicious group enumeration commands (e.g., 'net group', 'Get-ADGroupMember').
TimeWindow	Time threshold for correlating group discovery with subsequent suspicious activity (e.g., lateral movement).
UserContext	Whether the user performing discovery is in a sensitive group or running under unusual context (e.g., non-admin querying Domain Admins).

AN0508 · Linux

Detection of group enumeration using commands like 'id', 'groups', or 'getent group', often followed by privilege escalation or SSH lateral movement.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandLine	Variations of enumeration commands tailored to different Linux distros (e.g., 'getent group', 'cut -d' in /etc/group parsing).
TTYSession	TTY context or source terminal (remote shell vs local login) to reduce noise.

AN0509 · macOS

Group membership checks via 'dscl', 'dscacheutil', or 'id', typically executed via terminal or automation scripts.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	process:launch

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandLine	Filters for suspicious execution of 'dscl . -read /Groups', etc.
ParentProcess	Flag group enumeration from automation tools (e.g., LaunchAgents or suspicious apps).

Permission Groups Discovery detections T1069

5 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

64th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs