MITRE ATT&CKsub-technique

T1069.002 Domain Groups

Published 2020-02-21 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Discovery
Platforms
Linux, macOS, Windows
Version
1.2
Created
2020-02-21

Description

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators. Commands such as net group /domain of the Net utility, dscacheutil -q group on macOS, and ldapsearch on Linux can list domain-level groups.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1069 Permission Groups Discovery technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (39)

  • S9062 MiniBrowse software (malware)
  • S9035 LAMEHUG software (malware)
  • G1051 Medusa Group group
  • S1242 Qilin software (malware)
  • S1160 Latrodectus software (malware)
  • G1032 INC Ransom group
  • S1138 Gootloader software (malware)
  • G1022 ToddyCat group
  • S1081 BADHATCH software (malware)
  • G1017 Volt Typhoon group
  • G1015 Scattered Spider group
  • C0024 SolarWinds Compromise campaign
  • S1068 BlackCat software (malware)
  • S1063 Brute Ratel C4 software (tool)
  • C0015 C0015 campaign
  • G1004 LAPSUS$ group
  • S0692 SILENTTRINITY software (tool)
  • G0129 Mustang Panda group
  • S0554 Egregor software (malware)
  • S0552 AdFind software (tool)
  • S0521 BloodHound software (tool)
  • S0516 SoreFang software (malware)
  • S0514 WellMess software (malware)
  • S0496 REvil software (malware)
  • S0488 CrackMapExec software (tool)
  • G0100 Inception group
  • S0417 GRIFFON software (malware)
  • S0236 Kwampirs software (malware)
  • S0165 OSInfo software (malware)
  • S0170 Helminth software (malware)
Show all 39 ›