t1069-002-domain-groups

name	T1069.002_domain-groups
description	Adversaries may attempt to find domain-level groups and permission settings.
category	information-gathering
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1069.002","discovery","linux","macos","windows","sub-technique"]
technique_id	T1069.002
tactic	discovery
all_tactics	["discovery"]
platforms	["Linux","macOS","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1069/002
tech_stack	["linux","macos","windows"]
cwe_ids	["CWE-200"]
chains_with	["T1069","T1069.001","T1069.003"]
prerequisites	["T1069"]
severity_boost	{"T1069":"Chain with T1069 for deeper attack path","T1069.001":"Chain with T1069.001 for deeper attack path","T1069.003":"Chain with T1069.003 for deeper attack path"}

T1069.002 Domain Groups

Sub-technique of: T1069

High-Level Description

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.

Commands such as net group /domain of the Net utility, dscacheutil -q group on macOS, and ldapsearch on Linux can list domain-level groups.

Kill Chain Phase

• Discovery (TA0007)

Platforms: Linux, macOS, Windows

What to Check

• Identify if Domain Groups technique is applicable to target environment
• Check Linux systems for indicators of Domain Groups
• Check macOS systems for indicators of Domain Groups
• Check Windows systems for indicators of Domain Groups
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Basic Permission Groups Discovery Windows (Domain)

Basic Permission Groups Discovery for Windows. This test will display some errors if run on a computer not connected to a domain. Upon execution, domain information will be displayed.

Supported Platforms: windows

net localgroup
net group /domain
net group "enterprise admins" /domain
net group "domain admins" /domain

Atomic Test 2: Permission Groups Discovery PowerShell (Domain)

Permission Groups Discovery utilizing PowerShell. This test will display some errors if run on a computer not connected to a domain. Upon execution, domain information will be displayed.

Supported Platforms: windows

get-ADPrincipalGroupMembership #{user} | select name

Atomic Test 3: Elevated group enumeration using net group (Domain)

Runs "net group" command including command aliases and loose typing to simulate enumeration/discovery of high value domain groups. This test will display some errors if run on a computer not connected to a domain. Upon execution, domain information will be displayed.