T1069.002 Domain Groups

Technique

T1069.002

Tactics

Discovery

Research, 90 days

2

KEV CVEs mapped

0

SigmaHQ rules

15

Elastic, Splunk

33

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1069/002

MITRE description

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators. Commands such as <code>net group /domain</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscacheutil -q group</code> on macOS, and <code>ldapsearch</code> on Linux can list domain-level groups.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-11-03 TrustedSec: The Quiet Phase: Why Active Directory Group Enumeration Deserves Your Attention
• 2026-10-21 Group-IB: Stray Cat, Open Doors: How k0t Wanders Through the Network Edge

Detection coverage

SigmaHQ community rules

• Net.EXE Execution (threat-hunting)
• Potential Active Directory Reconnaissance/Enumeration Via LDAP (core)
• Reconnaissance Activity (core)
• BloodHound Collection Files (core)
• ADExplorer Writing Complete AD Snapshot Into .dat File (core)
• Malicious PowerShell Commandlets - PoshModule (core)
• Active Directory Group Enumeration With Get-AdGroup (core)
• Malicious PowerShell Commandlets - ScriptBlock (core)
• HackTool - Bloodhound/Sharphound Execution (core)
• HackTool - SharpView Execution (core)
• Malicious PowerShell Commandlets - ProcessCreation (core)
• PUA - AdFind Suspicious Execution (core)
• Renamed AdFind Execution (core)
• Active Directory Database Snapshot Via ADExplorer (core)
• Suspicious Active Directory Database Snapshot Via ADExplorer (core)

Elastic and Splunk rules

• Enumeration of Users or Groups via Built-in Commands (elastic)
• Potential Enumeration via Active Directory Web Service (elastic)
• Active Directory Discovery using AdExplorer (elastic)
• AdFind Command Activity (elastic)
• Enumeration of Administrator Accounts (elastic)
• Suspicious Access to LDAP Attributes (elastic)
• PowerShell Suspicious Discovery Related Windows API Functions (elastic)
• Windows Account or Group Discovery (elastic)
• Account or Group Discovery via Built-In Tools (elastic)
• Discovery of Domain Groups (elastic)
• Deprecated - PowerShell Script with Discovery Capabilities (elastic)
• Remote System Discovery Commands (elastic)
• Detect AzureHound Command-Line Arguments (splunk)
• Detect AzureHound File Modifications (splunk)
• Detect SharpHound Command-Line Arguments (splunk)
• Detect SharpHound File Modifications (splunk)
• Detect SharpHound Usage (splunk)
• Domain Group Discovery with Adsisearcher (splunk)
• Domain Group Discovery With Dsquery (splunk)
• Domain Group Discovery With Wmic (splunk)
• Elevated Group Discovery with PowerView (splunk)
• Elevated Group Discovery With Wmic (splunk)
• GetAdGroup with PowerShell (splunk)
• GetAdGroup with PowerShell Script Block (splunk)
• GetDomainGroup with PowerShell (splunk)

Showing 25 of 33.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.