T1069.002sub-technique of T1069 Permission Groups Discovery

Domain Groups

Linux · macOS · Windowsnothing on this site yetT1069.002 on attack.mitre.org

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.
MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Behavioral Detection of Domain Group Discovery

Detection of domain group enumeration through command-line utilities such as 'net group /domain' or PowerShell cmdlets, followed by suspicious access to API calls or LSASS memory.
Behavioral detection of domain group enumeration via ldapsearch or custom scripts leveraging LDAP over the network.
Enumeration of domain groups using dscacheutil or dscl commands, often following initial login or domain trust queries.

the rest of T1069

T1069.001 Local Groups · not covered yet
T1069.003 Cloud Groups · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.