TA0007 · DISCOVERY
Permission Groups Discovery
Enumerating group membership to identify who holds the keys to the domain or the tenant.
Detect it with
Repeated LDAP queries for privileged group membership from a single non-administrative host.
Why it matters on shift
Permission Groups Discovery is one of the concrete ways adversaries achieve discovery. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After discovery, the next tactic is usually Lateral Movement. Search your telemetry for the transition before closing the ticket.
3 sub-techniques
How it shows up in practice
- T1069.001
Local Groups
Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group.
- T1069.002
Domain Groups
Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group.
- T1069.003
Cloud Groups
Adversaries may attempt to find cloud groups and permission settings.
Kill-chain context