CmdID / Techniques / T1069

T1069.001 Permission Groups Discovery: Local Groups

Adversaries may attempt to find local system groups and permission settings. MITRE ATT&CK

1 program on CmdID 7 Sigma rules T1069.001 on attack.mitre.org

Part of

MITRE ATT&CK

T1069Permission Groups Discovery

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

wmic.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first

highHackTool - Bloodhound/Sharphound ExecutionFlorian Roth (Nextron Systems) · Windows

highMalicious PowerShell Commandlets - ProcessCreationNasreddine Bencherchali (Nextron Systems) · Windows

mediumPermission Check Via Accesschk.EXETeymur Kheirkhabarov (idea), Mangatas Tondang, oscd.community, Nasreddine Bencherchali (Nextron Systems) · Windows

lowLocal Groups Discovery Attempt - LinuxÖmer Günal, Alejandro Ortuno, oscd.community · Linux

lowLocal Groups Reconnaissance Via Wmic.EXEfrack113 · Windows

lowNet.EXE ExecutionMichael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements) · Windows

informationalLocal Groups Discovery - MacOsÖmer Günal, Alejandro Ortuno, oscd.community · macOS

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Get list of all groups on the page for getent

getent groupIdentify

See the members of a group on the page for getent

getent group group_nameIdentify

Print group memberships for the current user on the page for groups

groupsIdentify

Print group memberships for a list of users on the page for groups

groups username1 username2 ...Identify

Start or stop a Windows service synchronously on the page for net

net start serviceIdentify

Show the folders currently shared over SMB on the page for net

net shareIdentify

Show users in a local security group on the page for net

net localgroup "Administrators"Identify

To display a list of all user accounts for the local computer, run the following command on the page for net user

net userIdentify

To display information about the user account TommyH, run the following command on the page for net user

net user tommyhIdentify

To set the sign-in time from 8 AM to 5 PM for the username MikeD using 24-hour notation, run the following command on the page for net user

net user miked /time:M-F,08:00-17:00Identify

To set the sign-in time from 8 AM to 5 PM for MikeD using 12-hour notation, run the following command on the page for net user

net user miked /time:M-F,8AM-5PMIdentify

To specify sign-in hours of 4 AM to 12 PM on Monday, 12 PM to 8 PM on Tuesday, and 8 AM to 5 PM Wednesday through Friday for username AnibalS, run the following command on the page for net user

net user anibals /time:M,4AM-12PM;T,12PM-8PM;W-F,8AM-5PMIdentify

And 1 more example on CmdID’s program pages.

An example is here when CmdID’s reading of it names T1069.001: a Sigma rule it trips is tagged with it, or its abuse is documented as it.