MITRE ATT&CKsub-technique

T1069.001 Local Groups

Published 2020-03-12 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Discovery
Platforms
Linux, macOS, Windows
Version
1.2
Created
2020-03-12

Description

Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group. Commands such as net localgroup of the Net utility, dscl . -list /Groups on macOS, and groups on Linux can list local groups.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1069 Permission Groups Discovery technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (32)

  • C0061 Operation Digital Eye campaign
  • S1198 Gomir software (malware)
  • S1179 Exbyte software (malware)
  • S1141 LunarWeb software (malware)
  • G1017 Volt Typhoon group
  • C0015 C0015 campaign
  • C0014 Operation Wocao campaign
  • C0012 Operation CuckooBees campaign
  • S0696 Flagpro software (malware)
  • S0692 SILENTTRINITY software (tool)
  • S0650 QakBot software (malware)
  • G0131 Tonto Team group
  • S0572 Caterpillar WebShell software (malware)
  • S0521 BloodHound software (tool)
  • G0114 Chimera group
  • S0381 FlawedAmmyy software (malware)
  • S0378 PoshC2 software (tool)
  • G1001 HEXANE group
  • S0236 Kwampirs software (malware)
  • S0265 Kazuar software (malware)
  • S0201 JPIN software (malware)
  • S0165 OSInfo software (malware)
  • S0170 Helminth software (malware)
  • S0184 POWRUNER software (malware)
  • G0049 OilRig group
  • S0154 Cobalt Strike software (malware)
  • G0010 Turla group
  • G0018 admin@338 group
  • S0039 Net software (tool)
  • S0060 Sys10 software (malware)
Show all 32 ›