Permission Groups Discovery (MITRE ATT&CK T1069) is a Discovery technique. MITRE lists Containers, IaaS, Identity Provider, Linux, macOS, Office Suite, SaaS and Windows as platforms.
Adversaries try to discover group and permission settings. That tells them which accounts and groups exist, who belongs to which group, and which users and groups hold elevated permissions.
How attackers use it
MITRE notes this can be done in many ways and that the results shape follow-on activity. The technique has three sub-techniques: Local Groups, Domain Groups and Cloud Groups. The parent page stays general because the commands differ by environment.
How to detect it
MITRE's detection strategy is behavioral:
- Windows: enumeration of domain or local group membership through native tools such as net.exe, PowerShell or WMI, which may come before lateral movement or privilege escalation.
- Linux: commands like id, groups or getent group, often followed by privilege escalation or SSH lateral movement.
- macOS: group membership checks through dscl, dscacheutil or id, typically run from a terminal or automation scripts.
Group lookups are routine for admins and scripts, so one event means little. Look for bursts of discovery commands from an account that does not normally run them, especially right after a new logon.
How to reduce the risk
The parent technique lists no specific mitigations. Defense is detection plus narrow privilege, and the sub-technique posts cover details for local, domain and cloud groups.
Quick check
Why is a single group lookup a weak alert?
Admins and scripts run these commands all the time. Context matters: who ran it, how often, and what came next.
