Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions. Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.1
- CrowdStrike BloodHound April 2018
使用该技术的组织
| 组织 | 名称 | 国家 |
|---|---|---|
| grp_g1015 | Scattered Spider | — |
| grp_g1017 | Volt Typhoon | — |
| grp_g0022 | APT3 | China |
| grp_g0092 | TA505 | — |
| grp_g1016 | FIN13 | — |
| grp_g0096 | APT41 | China |
断言
尚无指向该技术的公开断言。
记录自动入库·未人工复核;置信度与有效期按引用读取。