Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group. Commands such as <code>net localgroup</code> of the Net utility, <code>dscl . -list /Groups</code> on macOS, and <code>groups</code> on Linux can list local groups.
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g1001 | HEXANE | — |
| grp_g0114 | Chimera | China |
| grp_g0131 | Tonto Team | China |
| grp_g0018 | admin@338 | China |
| grp_g0049 | OilRig | Iran |
| grp_g1017 | Volt Typhoon | — |
| grp_g0010 | Turla | Russia |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.