EXPLORE
← Back to Explore
T1069.001

Local Groups

Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group. Commands such as <code>net localgroup</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscl . -list...

LinuxmacOSWindows
35
Detections
3
Sources
7
Threat Actors

BY SOURCE

15sigma14splunk_escu6elastic

PROCEDURES (25)

Process Creation Monitoring3 detections

Auto-extracted: 3 detections for process creation monitoring

Powershell2 detections

Auto-extracted: 2 detections for powershell

Lateral2 detections

Auto-extracted: 2 detections for lateral

Remote2 detections

Auto-extracted: 2 detections for remote

Powershell2 detections

Auto-extracted: 2 detections for powershell

Powershell2 detections

Auto-extracted: 2 detections for powershell

Wmi2 detections

Auto-extracted: 2 detections for wmi

Privilege2 detections

Auto-extracted: 2 detections for privilege

General Monitoring2 detections

Auto-extracted: 2 detections for general monitoring

Service1 detections

Auto-extracted: 1 detections for service

Privilege1 detections

Auto-extracted: 1 detections for privilege

Service1 detections

Auto-extracted: 1 detections for service

Script Block1 detections

Auto-extracted: 1 detections for script block

Unusual1 detections

Auto-extracted: 1 detections for unusual

Suspicious1 detections

Auto-extracted: 1 detections for suspicious

Lateral1 detections

Auto-extracted: 1 detections for lateral

Persist1 detections

Auto-extracted: 1 detections for persist

Script Execution Monitoring1 detections

Auto-extracted: 1 detections for script execution monitoring

File Monitoring1 detections

Auto-extracted: 1 detections for file monitoring

Azure1 detections

Auto-extracted: 1 detections for azure

Azure1 detections

Auto-extracted: 1 detections for azure

Lateral1 detections

Auto-extracted: 1 detections for lateral

Unusual1 detections

Auto-extracted: 1 detections for unusual

Script Block1 detections

Auto-extracted: 1 detections for script block

Wmi1 detections

Auto-extracted: 1 detections for wmi

DETECTIONS (35)

AD Groups Or Users Enumeration Using PowerShell - PoshModule
sigmalow
AD Groups Or Users Enumeration Using PowerShell - ScriptBlock
sigmalow
BloodHound Collection Files
sigmahigh
Detect AzureHound Command-Line Arguments
splunk_escu
Detect AzureHound File Modifications
splunk_escu
Detect SharpHound Command-Line Arguments
splunk_escu
Detect SharpHound File Modifications
splunk_escu
Detect SharpHound Usage
splunk_escu
Enumeration of Administrator Accounts
elasticlow
Enumeration of Privileged Local Groups Membership
elasticmedium
Enumeration of Users or Groups via Built-in Commands
elasticlow
Get WMIObject Group Discovery
splunk_escu
Get WMIObject Group Discovery with Script Block Logging
splunk_escu
HackTool - Bloodhound/Sharphound Execution
sigmahigh
Local Groups Discovery - Linux
sigmalow
Local Groups Discovery - MacOs
sigmainformational
Local Groups Reconnaissance Via Wmic.EXE
sigmalow
Malicious PowerShell Commandlets - PoshModule
sigmahigh
Malicious PowerShell Commandlets - ProcessCreation
sigmahigh
Malicious PowerShell Commandlets - ScriptBlock
sigmahigh
Network Traffic to Active Directory Web Services Protocol
splunk_escu
Permission Check Via Accesschk.EXE
sigmamedium
PowerShell Get LocalGroup Discovery
splunk_escu
Powershell Get LocalGroup Discovery with Script Block Logging
splunk_escu
PowerShell Suspicious Discovery Related Windows API Functions
elasticlow
Sudo Command Enumeration Detected
elasticlow
Suspicious Get Information for SMB Share
sigmalow
Suspicious Get Information for SMB Share - PowerShell Module
sigmalow
Suspicious Get Local Groups Information
sigmalow
Suspicious Get Local Groups Information - PowerShell
sigmalow
Unusual User Privilege Enumeration via id
elasticmedium
Windows Admin Permission Discovery
splunk_escu
Windows Group Discovery Via Net
splunk_escu
Windows SOAPHound Binary Execution
splunk_escu
Wmic Group Discovery
splunk_escu