Detecting and Mitigating Local Groups Discovery (T1069.001)

Local Groups discovery (MITRE ATT&CK T1069.001) is a Discovery technique. MITRE lists Linux, macOS and Windows as platforms.

Adversaries look for local system groups and their permission settings. Knowing which groups exist and who belongs to them lets an intruder find which users hold elevated rights, such as the members of the local administrators group.

How attackers use it

MITRE names a command for each OS:

• net localgroup of the Net utility on Windows.
• dscl . -list /Groups on macOS.
• groups on Linux.

These are ordinary admin commands. That is the whole difficulty.

How to detect it

MITRE's detection strategy covers three platforms:

• Windows: attempts to enumerate local groups through Net.exe, PowerShell or native API calls that come before lateral movement or privilege abuse.
• Linux: enumeration through common binaries such as groups, getent or cat /etc/group, or through scripts with suspicious lineage.
• macOS: dscl or id and group commands, often run by post-exploitation tools or persistence checks.

Data to have: process creation logs with command line and parent process (Windows Security 4688 with command line auditing, Sysmon Event ID 1, or auditd on Linux). Then look at lineage. A web server process or an Office document that spawns net localgroup is far more interesting than an admin at a console.

How to reduce the risk

MITRE lists no mitigations for this technique because it abuses normal system features. Practical steps are to keep local admin membership short and known, log command lines everywhere, and alert on discovery commands launched by unusual parents.

Check your own environment

# Windows PowerShell: who is in local Administrators right now (read only)
Get-LocalGroupMember -Group "Administrators"

# Linux: members of the sudo-capable groups (read only; group name varies by distro)
getent group sudo wheel

Compare the lists with what you expect. Surprises are findings.

Quick check

Sources

• MITRE ATT&CK T1069.001: Local Groups