CyberStack

MITRE ATT&CK / Techniques / T1069.002

Permission Groups Discovery: Domain Groups

ID
T1069.002
Tactics
TA0007 Discovery
Sub-technique of
T1069 Permission Groups Discovery
Platforms
Linux, macOS, Windows
Data sources
Process Creation, Command Execution, Network Traffic Content
Source
attack.mitre.org
MITRE last modified
12 May 2026

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.

Commands such as net group /domain of the Net utility, dscacheutil -q group on macOS, and ldapsearch on Linux can list domain-level groups.

Detection

Groups (13)

Software (24)