T1069.002Discovery
Domain Groups
Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators. Commands such as net group /domain of the Net utility…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
15 Sigma rules tagged T1069.002Domain GroupsT1069.00215 general rules
- BloodHound Collection Fileshightest
- HackTool - Bloodhound/Sharphound Executionhightest
- HackTool - SharpView Executionhightest
- Malicious PowerShell Commandlets - PoshModulehightest
- Malicious PowerShell Commandlets - ProcessCreationhightest
- Malicious PowerShell Commandlets - ScriptBlockhightest
- PUA - AdFind Suspicious Executionhightest
- Reconnaissance Activityhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Domain Groups
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.