T1069

Permission Groups Discovery

Containers · IaaS · Identity Provider · Linux · macOS · Office Suite · SaaS · Windowsnothing on this site yetT1069 on attack.mitre.org

Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions. Adversaries may attempt to discover group permission settings in many different ways.
MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Behavioral Detection of Permission Groups Discovery

Detection of adversary enumeration of domain or local group memberships via native tools such as net.exe, PowerShell, or WMI. This activity may precede lateral movement or privilege escalation.
Detection of group enumeration using commands like 'id', 'groups', or 'getent group', often followed by privilege escalation or SSH lateral movement.
Group membership checks via 'dscl', 'dscacheutil', or 'id', typically executed via terminal or automation scripts.

sub-techniques

T1069.001 Local Groups · not covered yet
T1069.002 Domain Groups · not covered yet
T1069.003 Cloud Groups · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.