T1069Discovery

Permission Groups Discovery

Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions. Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with…

attack.mitre.org ↗

CVEs1

In 1

Reports0

Sub-techniques T1069.001Local Groups T1069.002Domain Groups T1069.003Cloud Groups

Detections

3 Sigma rules tagged T1069

Permission Groups DiscoveryT10693 general rules

Malicious PowerShell Commandlets - PoshModulehightest
Malicious PowerShell Commandlets - ProcessCreationhightest
Malicious PowerShell Commandlets - ScriptBlockhightest

CVEs linked to Permission Groups Discovery

1 CVE, by priority. Each link shows its badge.

CVE-2021-44515Zoho Desktop Central Authentication Bypass Vulnerability
Zoho · Desktop CentralKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1003OS Credential Dumping+3 more
MITRE CTID mapping of the KEV entry · follow-on activity
99.9%Top 0.04%
69.9priority