MITRE ATT&CKtechnique
T1069 Permission Groups Discovery
- Domain
- enterprise
- Tactics
- Discovery
- Platforms
- Containers, IaaS, Identity Provider, Linux, macOS, Office Suite, SaaS, Windows
- Version
- 2.6
- Created
- 2017-05-31
Description
Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions.
Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.
Related
Tactic · MITRE ATT&CK (1)
- TA0007 Discovery tactic
Referenced by MITRE ATT&CK · subtechnique of (3)
Referenced by MITRE ATT&CK · uses (13)
- G1016 FIN13 group
- G1017 Volt Typhoon group
- G1015 Scattered Spider group
- C0024 SolarWinds Compromise campaign
- S0623 Siloscape software (malware)
- S0483 IcedID software (malware)
- S0445 ShimRatReporter software (tool)
- G0096 APT41 group
- G0092 TA505 group
- S0335 Carbon software (malware)
- S0266 TrickBot software (malware)
- S0233 MURKYTOP software (malware)
- G0022 APT3 group
Referenced by CAPEC · att&ck technique (1)
- CAPEC-576 Group Permission Footprinting attack pattern
References
- https://kubernetes.io/docs/reference/access-authn-authz/authorization/ K8s Authorization Overview
- https://www.crowdstrike.com/blog/hidden-administrative-accounts-bloodhound-to-the-rescue/ CrowdStrike BloodHound April 2018