T1069 · Permission Groups Discovery

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1069 · Permission Groups Discovery · Sunturai

attack-patternenterprise-attackT1069

Permission Groups Discovery

attack-pattern--15dbf668-795c-41e6-8219-f0447c0e64ce

Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions. Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.(Citation: CrowdStrike BloodHound April 2018)

Created: May 31, 2017, 9:30 PM UTC
Modified: Oct 24, 2025, 5:48 PM UTC

3 sub-techniques under this technique

Each is its own technique in the catalogue, with its own detections.

39 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Cloud Offensive Framework Execution	Medium	Elastic detection rules	Oct 9, 2026	Elastic License 2.0
AdFind Command Activity	Low	Elastic detection rules	Oct 8, 2026	Elastic License 2.0
Anthropic Organization Member and Group Enumeration	Medium	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
Whoami Process Activity	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Enumeration of Privileged Local Groups Membership	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
PowerShell Suspicious Discovery Related Windows API Functions	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Access to LDAP Attributes	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Enumeration of Administrator Accounts	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Active Directory Discovery using AdExplorer	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Enumeration via Active Directory Web Service	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Enumeration of Users or Groups via Built-in Commands	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual User Privilege Enumeration via id	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Sudo Command Enumeration Detected	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual Group Name Accessed by a User	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Kubernetes Suspicious Self-Subject Review via Unusual User Agent	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
GKE Suspicious Self-Subject Review via Service Account	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Entra ID Sign-in TeamFiltration User-Agent Detected	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Entra ID Sign-in BloodHound Suite User-Agent Detected	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Azure AKS Suspicious Self-Subject Review by Service Account or Node Identity	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Azure AD Graph Access with Suspicious User-Agent	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Azure AD Graph Potential Enumeration (ROADrecon)	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Entra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
AWS IAM Principal Enumeration via UpdateAssumeRolePolicy	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Kubernetes Direct API Request via Curl or Wget	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Direct Interactive Kubernetes API Request by Unusual Utilities	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0

Showing 25 of 39

Filter in the catalogue

External references

mitre-attackT1069Open reference

K8s Authorization OverviewOpen reference

CrowdStrike BloodHound April 2018Open reference

Platforms

ContainersIaaSIdentity ProviderLinuxmacOSOffice SuiteSaaSWindows

Kill chain phases

discovery

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object