Permission Groups Discovery
- ID
- T1069
- Tactics
- TA0007 Discovery
- Platforms
- Containers, IaaS, Identity Provider, Linux, macOS, Office Suite, SaaS, Windows
- Data sources
- Process Creation, Command Execution
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions.
Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.[1]
Sub-techniques (3)
Detection
- DET0179 Behavioral Detection of Permission Groups Discovery
Data components: Process Creation, Command Execution