Detecting and Mitigating Domain Groups Discovery (T1069.002)

Domain Groups discovery (MITRE ATT&CK T1069.002) is a Discovery technique. MITRE lists Linux, macOS and Windows as platforms.

Adversaries look for domain-level groups and their permission settings. Knowing which groups exist and who belongs to them helps an intruder find users with elevated permissions, such as domain administrators.

How attackers use it

MITRE names these commands:

• net group /domain of the Net utility on Windows.
• dscacheutil -q group on macOS.
• ldapsearch on Linux.

A single account that can query the directory can usually list all groups. That is by design, so the query itself is rarely blocked.

How to detect it

MITRE's detection strategy has three analytics:

• Windows: domain group enumeration through command line utilities such as net group /domain or PowerShell cmdlets, followed by suspicious API calls or access to LSASS memory.
• Linux: domain group enumeration through ldapsearch or custom scripts that use LDAP over the network.
• macOS: enumeration through dscacheutil or dscl, often right after initial login or domain trust queries.

Useful data includes process creation with command line, and directory service logs that show LDAP queries by account and source host. A workstation that suddenly runs many group queries is worth a check, particularly when the account is not an admin.

How to reduce the risk

MITRE lists no mitigations because the technique abuses normal features. In practice:

• Keep privileged groups small and reviewed.
• Log LDAP query volume from endpoints, if your directory supports it.
• Alert on enumeration commands launched by Office, browsers or services.

Check your own environment

# Windows PowerShell with the ActiveDirectory module: who is in Domain Admins (read only)
Get-ADGroupMember -Identity "Domain Admins" | Select-Object Name, SamAccountName

Ask who is on that list and when each person was last reviewed.

Quick check

Sources

• MITRE ATT&CK T1069.002: Domain Groups