T1069 Permission Groups Discovery

Adversaries may attempt to discover group and permission settings. MITRE ATT&CK

1 Sigma rule T1069 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK

T1069.001Permission Groups Discovery: Local Groups

T1069.002Permission Groups Discovery: Domain Groups

Sigma rules tagged with it

process creation, the highest levels first

highMalicious PowerShell Commandlets - ProcessCreationNasreddine Bencherchali (Nextron Systems) · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Suspend a workflow job by name on the page for Suspend-Job

#Sample Workflow
workflow Get-SystemLog
{
$Events = Get-WinEvent -LogName System
CheckPoint-Workflow
inlinescript {\\Server01\Scripts\Analyze-SystemEvents.ps1 -Events $Events}
}
Get-SystemLog -AsJob -JobName "LogflowJob"
Get-Job -Name LogflowJob

Identify

An example is here when CmdID’s reading of it names T1069: a Sigma rule it trips is tagged with it, or its abuse is documented as it.