CircleCI Atomic Red Team doc generator
1.3 KiB
1.3 KiB
T1069 - Permission Groups Discovery
Description from ATT&CK
Adversaries may attempt to find local system or domain-level groups and permissions settings.Windows
Examples of commands that can list groups are
net group /domainandnet localgroupusing the Net utility.Mac
On Mac, this same thing can be accomplished with the
dscacheutil -q groupfor the domain, ordscl . -list /Groupsfor local groups.Linux
On Linux, local groups can be enumerated with the
groupscommand and domain groups via theldapsearchcommand.
Atomic Tests
Atomic Test #1 - Elevated group enumeration using net group
Runs 'net group' command including command aliases and loose typing to simulate enumeration/discovery of high value domain groups
Supported Platforms: Windows
Run it with command_prompt!
net group /domai 'Domain Admins'
net groups 'Account Operators' /doma
net groups 'Exchange Organization Management' /doma
net group 'BUILTIN\Backup Operators' /doma