tfMITRE ATT&CK technique

Permission Groups Discovery T1069

Tactic: Discovery
Platforms: Containers, IaaS, Identity Provider, Linux, macOS, Office Suite, SaaS, Windows
Version: 2.6
Created: 31 May 2017
Last modified: 24 October 2025
Contributors: Daniel Prizmant, Palo Alto Networks; Yuval Avrahami, Palo Alto Networks; Microsoft Threat Intelligence Center (MSTIC)

Sub-techniques 358 rules across the family · 5 mapped directly to T1069 · 3 of 3 carry rules

.001Local Groups30 .002Domain Groups36 .003Cloud Groups4

Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 25%

Threat groups75th percentile · 73% of ATT&CK techniques have fewer threat groups attributed.

Campaigns72nd pct

Campaigns72nd percentile · 54% of ATT&CK techniques have fewer campaigns recorded.

Tools & malware68th pct

Tools & malware68th percentile · 66% of ATT&CK techniques have fewer tools implementing them.

Detection rules64th pct

Detection rules64th percentile · 60% of ATT&CK techniques have fewer detection rules written.

Offense vs defense T1069

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 1Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 2

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106

Data component

Name

Channel

Process CreationDC0032

WinEventLog:Security

EventCode=4688

Command ExecutionDC0064

WinEventLog:PowerShell

EventCode=4103, 4104, 4105, 4106

Field	What you tune
CommandLineRegex	Regex filters for matching suspicious group enumeration commands (e.g., 'net group', 'Get-ADGroupMember').
TimeWindow	Time threshold for correlating group discovery with subsequent suspicious activity (e.g., lateral movement).
UserContext	Whether the user performing discovery is in a sensitive group or running under unusual context (e.g., non-admin querying Domain Admins).

Field

What you tune

CommandLineRegex

Regex filters for matching suspicious group enumeration commands (e.g., 'net group', 'Get-ADGroupMember').

TimeWindow

Time threshold for correlating group discovery with subsequent suspicious activity (e.g., lateral movement).

UserContext

Whether the user performing discovery is in a sensitive group or running under unusual context (e.g., non-admin querying Domain Admins).

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve

Field	What you tune
CommandLine	Variations of enumeration commands tailored to different Linux distros (e.g., 'getent group', 'cut -d' in /etc/group parsing).
TTYSession	TTY context or source terminal (remote shell vs local login) to reduce noise.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	process:launch

Field	What you tune
CommandLine	Filters for suspicious execution of 'dscl . -read /Groups', etc.
ParentProcess	Flag group enumeration from automation tools (e.g., LaunchAgents or suspicious apps).

Offense vs defense T1069

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 1Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 2

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106

Data component

Name

Channel

Process CreationDC0032

WinEventLog:Security

EventCode=4688

Command ExecutionDC0064

WinEventLog:PowerShell

EventCode=4103, 4104, 4105, 4106

Field	What you tune
CommandLineRegex	Regex filters for matching suspicious group enumeration commands (e.g., 'net group', 'Get-ADGroupMember').
TimeWindow	Time threshold for correlating group discovery with subsequent suspicious activity (e.g., lateral movement).
UserContext	Whether the user performing discovery is in a sensitive group or running under unusual context (e.g., non-admin querying Domain Admins).

Field

What you tune

CommandLineRegex

Regex filters for matching suspicious group enumeration commands (e.g., 'net group', 'Get-ADGroupMember').

TimeWindow

Time threshold for correlating group discovery with subsequent suspicious activity (e.g., lateral movement).

UserContext

Whether the user performing discovery is in a sensitive group or running under unusual context (e.g., non-admin querying Domain Admins).

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve

Field	What you tune
CommandLine	Variations of enumeration commands tailored to different Linux distros (e.g., 'getent group', 'cut -d' in /etc/group parsing).
TTYSession	TTY context or source terminal (remote shell vs local login) to reduce noise.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	process:launch

Field	What you tune
CommandLine	Filters for suspicious execution of 'dscl . -read /Groups', etc.
ParentProcess	Flag group enumeration from automation tools (e.g., LaunchAgents or suspicious apps).

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects Commandlet names from well-known PowerShell exploitation frameworks	Generic	test	ps_module	windows	PowerShell	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	CVE-2021-1675	high	Nasreddine Bencherchali (Nextron Systems)	2023-01-20	2025-12-10	7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c
	Detects Commandlet names from well-known PowerShell exploitation frameworks	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	CVE-2021-1675	high	Nasreddine Bencherchali (Nextron Systems)	2023-01-02	2025-12-10	02030f2f-6199-49ec-b258-ea71b07e03dc
	Detects Commandlet names from well-known PowerShell exploitation frameworks	Generic	test	ps_script	windows	PowerShell	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	CVE-2021-1675	high	Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer	2017-03-05	2025-12-10	89819aa4-bbd6-46bc-88ec-c7f7fe30efa6
Splunk	The following analytic identifies four or more distinct post-exploitation behaviors on a Windows system. (...)	Correlation	stable	-	-	-	Collection Clipboard Data Credential Access OS Credential Dumping Discovery Permission Groups Discovery Discovery Query Registry Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Credential Access Unsecured Credentials	-	medium	Teoderick Contreras, Splunk	2023-06-14	2026-05-13	edb930df-64c2-4bb7-9b5c-889ed53fb973
Splunk	The following analytic detects the execution of PowerView PowerShell cmdlets `Get-ObjectAcl` or `Get-DomainObjectAcl`, which are used to enumerate Access Control List (ACL) permissions for Active Directory objects. (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Permission Groups Discovery Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Domain Accounts	-	medium	Mauricio Velazco, Splunk	2023-04-21	2026-05-13	39405650-c364-4e1e-a740-32a63ef042a6

Title

Description

Permission Groups Discovery T1069

Permission Groups Discovery T1069

Permission Groups Discovery MITRE reference T1069

Offense vs defense T1069

Permission Groups Discovery detection strategy DET0179

Behavioral Detection of Permission Groups Discovery

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Permission Groups Discovery MITRE reference T1069

Offense vs defense T1069

Permission Groups Discovery detection strategy DET0179

Behavioral Detection of Permission Groups Discovery

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Permission Groups Discovery detections T1069

Permission Groups Discovery detections T1069