diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index 5e9c5ab3..4a0fed03 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -54435,6 +54435,9 @@ discovery: if [ -x "$(command -v dscacheutil)" ]; then dscacheutil -q group; else echo "dscacheutil is missing from the machine. skipping..."; fi; if [ -x "$(command -v dscl)" ]; then dscl . -list /Groups; else echo "dscl is missing from the machine. skipping..."; fi; if [ -x "$(command -v groups)" ]; then groups; else echo "groups is missing from the machine. skipping..."; fi; + if [ -x "$(command -v id)" ]; then id; else echo "id is missing from the machine. skipping..."; fi; + if [ -x "$(command -v getent)" ]; then getent group; else echo "getent is missing from the machine. skipping..."; fi; + cat /etc/group name: sh - name: Basic Permission Groups Discovery Windows (Local) auto_generated_guid: 1f454dd6-e134-44df-bebb-67de70fb6cd8 diff --git a/atomics/T1069.001/T1069.001.md b/atomics/T1069.001/T1069.001.md index a331a026..26a4f5b3 100644 --- a/atomics/T1069.001/T1069.001.md +++ b/atomics/T1069.001/T1069.001.md @@ -41,6 +41,9 @@ Permission Groups Discovery if [ -x "$(command -v dscacheutil)" ]; then dscacheutil -q group; else echo "dscacheutil is missing from the machine. skipping..."; fi; if [ -x "$(command -v dscl)" ]; then dscl . -list /Groups; else echo "dscl is missing from the machine. skipping..."; fi; if [ -x "$(command -v groups)" ]; then groups; else echo "groups is missing from the machine. skipping..."; fi; +if [ -x "$(command -v id)" ]; then id; else echo "id is missing from the machine. skipping..."; fi; +if [ -x "$(command -v getent)" ]; then getent group; else echo "getent is missing from the machine. skipping..."; fi; +cat /etc/group ```