Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators. Commands such as <code>net group /domain</code> of the Net utility, <code>dscacheutil -q group</code> on macOS, and <code>ldapsearch</code> on Linux can list domain-level groups.
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g0100 | Inception | — |
| grp_g0129 | Mustang Panda | China |
| grp_g0004 | Ke3chang | — |
| grp_g1051 | Medusa Group | — |
| grp_g1015 | Scattered Spider | — |
| grp_g0035 | Dragonfly | Russia |
| grp_g0049 | OilRig | Iran |
| grp_g1004 | LAPSUS$ | — |
| grp_g1017 | Volt Typhoon | — |
| grp_g0046 | FIN7 | — |
| grp_g1032 | INC Ransom | — |
| grp_g0010 | Turla | Russia |
| grp_g1022 | ToddyCat | — |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.