Forensia CTI Core

About

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators. Commands such as <code>net group /domain</code> of the Net utility, <code>dscacheutil -q group</code> on macOS, and <code>ldapsearch</code> on Linux can list domain-level groups.

Platforms: Linux, macOS, WindowsParent: T1069 Permission Groups DiscoveryMITRE ATT&CK ↗

Used by actors

13 known groups

G0004 Ke3chang G0010 Turla G0035 Dragonfly G0046 FIN7 G0049 OilRig G0100 Inception G0129 Mustang Panda G1004 LAPSUS$G1015 Scattered Spider G1017 Volt Typhoon G1022 ToddyCat G1032 INC Ransom G1051 Medusa Group

Software

23 malware/tools implement this

NetdsqueryCobalt StrikeOSInfoHelminthPOWRUNERKwampirsGRIFFONCrackMapExecREvilWellMessSoreFangBloodHoundAdFindEgregorSILENTTRINITYBrute Ratel C4BlackCatBADHATCHGootloaderLatrodectusQilinLAMEHUG

Corpus indicators tagged with this technique

56 indicators in the corpus carry T1069.002.

Indicator	Type	Family	Sev	Src
cve-2021-27076	cve	—	85	1
a14506c6fb92a5af88a6a44d273edafe10d69ee3d85c8b2a7ac458a22edf68d2	sha256	ransomware	80	1
6a5f9bd0e4a0c385b98cc7b528be53a95ff9c4ccffa8c1f65448ab792a46186c	sha256	—	80	1
a6df0b49a5ef9ffd6513bfe061fb60f6d2941a440038e2de8a7aeb1914945331	sha256	ransomware	80	1
2758f4d71a2a2dfdefab81737c2d776b2a3dafe5844fdd2157e089a28447ca98	sha256	phishing	80	1
38353f95fff270f4e3a9d7add8c64666020dd668ce66e15969a736ec48cadc59	sha256	phishing	80	1
4253dd1a4c0867b0be7732f75b2f630cebfb7fed94270e15fb3b12ae40546d01	sha256	phishing	80	1
479ae5fd7274439ddfa27bc03298ebfdfc5ff17f6412acccf74d4dbd90d94218	sha256	phishing	80	1
874bcb1c3d050a5b5b333a2198f504fcb27927c2abdd43b07440188a380c52d5	sha256	phishing	80	1
9eaa577c8ba71646928c1c34c3145536b0498f65f26060a6ba00744bcef57644	sha256	phishing	80	1
6ba5d96e52734cbb9246bcc3decf127f780d48fa11587a1a44880c1f04404d23	sha256	ransomware	80	1
18b8e6762afd29a09becae283083c74a19fc09db1f2c3412c42f1b0178bc122a	sha256	ransomware	80	1
186b26df63df3b7334043b47659cba4185c948629d857d47452cc1936f0aa5da	sha256	ransomware	80	1
39bd9c888d3e8110c127ba60cc727d2538bf7da2	hash	ransomware	80	1
4200b46a93c6ab059e2b34ce200c4a5b	hash	ransomware	80	2
42bcc743c71a9ea083c1c750a398110582796762	hash	ransomware	80	2
23fd50b3bcc06f5adcbd0122c32260786ec3b98a	sha1	—	78	1
1b9aa401457d29405c0bcf19cbf19a7028a0d214	sha1	ransomware	78	1
febbaf5f08a8e0782ffcce8beef1f2b4e249a52b	sha1	ransomware	78	1
268a8420b791df46380ed9ad69905207e15d8a7c	sha1	phishing	78	1
f352cec89a56e23dae20cdd62df4d40bc7f22b5e	sha1	ransomware	78	1
a514d1bb62d7916475946fe7c07ac0aa	md5	—	76	1
aa3086be652c8b20b0b29b2730d57119	md5	—	76	1
b3352b42432dedc4a519f011dc8b5d5a	md5	—	76	1
c559cc68986933200fd5d9e4388e2f58	md5	—	76	1
d98f568496512e4f98670c61c97cb07a	md5	—	76	1
bcee0ab10b23f5999bcdb56c0b4a631a	md5	ransomware	76	1
ca8646dfc88423bb9fffda811160cebe	md5	ransomware	76	1
7f74bb6ba185978134c318bc5f91d23c	md5	phishing	76	1
a746da514c90f26a187a294fda7edc1b	md5	ransomware	76	1

Showing the top 30 by severity of 56.