CircleCI Atomic Red Team doc generator
74 lines
1.9 KiB
Markdown
74 lines
1.9 KiB
Markdown
# T1069 - Permission Groups Discovery
|
|
## [Description from ATT&CK](https://attack.mitre.org/wiki/Technique/T1069)
|
|
<blockquote>Adversaries may attempt to find local system or domain-level groups and permissions settings.
|
|
|
|
### Windows
|
|
|
|
Examples of commands that can list groups are <code>net group /domain</code> and <code>net localgroup</code> using the [Net](https://attack.mitre.org/software/S0039) utility.
|
|
|
|
### Mac
|
|
|
|
On Mac, this same thing can be accomplished with the <code>dscacheutil -q group</code> for the domain, or <code>dscl . -list /Groups</code> for local groups.
|
|
|
|
### Linux
|
|
|
|
On Linux, local groups can be enumerated with the <code>groups</code> command and domain groups via the <code>ldapsearch</code> command.</blockquote>
|
|
|
|
## Atomic Tests
|
|
|
|
- [Atomic Test #1 - Permission Groups Discovery](#atomic-test-1---permission-groups-discovery)
|
|
|
|
- [Atomic Test #2 - Permission Groups Discovery Windows](#atomic-test-2---permission-groups-discovery-windows)
|
|
|
|
- [Atomic Test #3 - Permission Groups Discovery PowerShell](#atomic-test-3---permission-groups-discovery-powershell)
|
|
|
|
|
|
<br/>
|
|
|
|
## Atomic Test #1 - Permission Groups Discovery
|
|
Permission Groups Discovery
|
|
|
|
**Supported Platforms:** macOS, Linux
|
|
|
|
|
|
#### Run it with `sh`!
|
|
```
|
|
dscacheutil -q group
|
|
dscl . -list /Groups
|
|
groups
|
|
```
|
|
<br/>
|
|
<br/>
|
|
|
|
## Atomic Test #2 - Permission Groups Discovery Windows
|
|
Permission Groups Discovery for Windows
|
|
|
|
**Supported Platforms:** Windows
|
|
|
|
|
|
#### Run it with `command_prompt`!
|
|
```
|
|
net localgroup
|
|
net group /domain
|
|
```
|
|
<br/>
|
|
<br/>
|
|
|
|
## Atomic Test #3 - Permission Groups Discovery PowerShell
|
|
Permission Groups Discovery utilizing PowerShell
|
|
|
|
**Supported Platforms:** Windows
|
|
|
|
|
|
#### Inputs
|
|
| Name | Description | Type | Default Value |
|
|
|------|-------------|------|---------------|
|
|
| user | User to identify what groups a user is a member of | string | administrator|
|
|
|
|
#### Run it with `powershell`!
|
|
```
|
|
get-localgroup
|
|
get-ADPrinicipalGroupMembership #{user} | select name
|
|
```
|
|
<br/>
|