Applied Cybernetics Group
T1069 Permission Groups Discovery
- Technique
T1069- Tactics
- Discovery
- Research, 90 days
- 0
- KEV CVEs mapped
- 1
- SigmaHQ rules
- 3
- Elastic, Splunk
- 37
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1069
MITRE description
Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions. Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.(Citation: CrowdStrike BloodHound April 2018)
KEV CVEs mapped to this technique
MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.
Detection coverage
SigmaHQ community rules
- Malicious PowerShell Commandlets - PoshModule (core)
- Malicious PowerShell Commandlets - ScriptBlock (core)
- Malicious PowerShell Commandlets - ProcessCreation (core)
Elastic and Splunk rules
- Cloud Offensive Framework Execution (elastic)
- Kubectl Permission Discovery (elastic)
- Direct Interactive Kubernetes API Request by Unusual Utilities (elastic)
- Kubernetes Direct API Request via Curl or Wget (elastic)
- Anthropic Organization Member and Group Enumeration (elastic)
- AWS IAM Principal Enumeration via UpdateAssumeRolePolicy (elastic)
- AWS EKS Suspicious Self-Subject Review via Unusual User Agent (elastic)
- Entra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration (elastic)
- Azure AD Graph Potential Enumeration (ROADrecon) (elastic)
- Azure AD Graph Access with Suspicious User-Agent (elastic)
- Azure AKS Suspicious Self-Subject Review by Service Account or Node Identity (elastic)
- Entra ID Sign-in BloodHound Suite User-Agent Detected (elastic)
- Entra ID Sign-in TeamFiltration User-Agent Detected (elastic)
- Microsoft Graph Application Directory Reconnaissance with Denied Requests (elastic)
- GKE Suspicious Self-Subject Review via Service Account (elastic)
- Kubernetes Suspicious Self-Subject Review via Unusual User Agent (elastic)
- Unusual Group Name Accessed by a User (elastic)
- Sudo Command Enumeration Detected (elastic)
- Unusual User Privilege Enumeration via id (elastic)
- Enumeration of Users or Groups via Built-in Commands (elastic)
- Potential Enumeration via Active Directory Web Service (elastic)
- Active Directory Discovery using AdExplorer (elastic)
- AdFind Command Activity (elastic)
- Enumeration of Administrator Accounts (elastic)
- Suspicious Access to LDAP Attributes (elastic)
Showing 25 of 37.