t1069-001-local-groups

name	T1069.001_local-groups
description	Adversaries may attempt to find local system groups and permission settings.
category	information-gathering
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1069.001","discovery","linux","macos","windows","sub-technique"]
technique_id	T1069.001
tactic	discovery
all_tactics	["discovery"]
platforms	["Linux","macOS","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1069/001
tech_stack	["linux","macos","windows"]
cwe_ids	["CWE-200"]
chains_with	["T1069","T1069.002","T1069.003"]
prerequisites	["T1069"]
severity_boost	{"T1069":"Chain with T1069 for deeper attack path","T1069.002":"Chain with T1069.002 for deeper attack path","T1069.003":"Chain with T1069.003 for deeper attack path"}

T1069.001 Local Groups

Sub-technique of: T1069

High-Level Description

Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.

Commands such as net localgroup of the Net utility, dscl . -list /Groups on macOS, and groups on Linux can list local groups.

Kill Chain Phase

• Discovery (TA0007)

Platforms: Linux, macOS, Windows

What to Check

• Identify if Local Groups technique is applicable to target environment
• Check Linux systems for indicators of Local Groups
• Check macOS systems for indicators of Local Groups
• Check Windows systems for indicators of Local Groups
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Permission Groups Discovery (Local)

Permission Groups Discovery

Supported Platforms: linux, macos

if [ -x "$(command -v dscacheutil)" ]; then dscacheutil -q group; else echo "dscacheutil is missing from the machine. skipping..."; fi;
if [ -x "$(command -v dscl)" ]; then dscl . -list /Groups; else echo "dscl is missing from the machine. skipping..."; ;
 [ -x  ];  ;   ; ;
 [ -x  ];  ;   ; ;
 [ -x  ];  getent group;   ; ;
 /etc/group