自动化接入 · API / MCP EN

技术说明 · T1069

Permission Groups Discovery

Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions. Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.

ATT&CK T1069 platforms — 状态 有效 版本 20.1

Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions. Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.1

  1. CrowdStrike BloodHound April 2018

使用该技术的组织

组织名称国家
grp_g1015Scattered Spider—
grp_g1017Volt Typhoon—
grp_g0022APT3China
grp_g0092TA505—
grp_g1016FIN13—
grp_g0096APT41China

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核;置信度与有效期按引用读取。