T1069.001 Local Groups — Detection Rules

Source-backed rule directory

• Local Groups Discovery - Linux · test · low · {"category":"process_creation","product":"linux"}
• Local Groups Discovery - MacOs · test · informational · {"category":"process_creation","product":"macos"}
• BloodHound Collection Files · test · high · {"product":"windows","category":"file_event"}
• Malicious PowerShell Commandlets - PoshModule · test · high · {"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"}
• AD Groups Or Users Enumeration Using PowerShell - PoshModule · test · low · {"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"}
• Suspicious Get Local Groups Information · test · low · {"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"}
• Suspicious Get Information for SMB Share - PowerShell Module · test · low · {"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"}
• Malicious PowerShell Commandlets - ScriptBlock · test · high · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
• AD Groups Or Users Enumeration Using PowerShell - ScriptBlock · test · low · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
• Suspicious Get Local Groups Information - PowerShell · test · low · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
• Suspicious Get Information for SMB Share · test · low · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
• HackTool - Bloodhound/Sharphound Execution · test · high · {"category":"process_creation","product":"windows"}
• Malicious PowerShell Commandlets - ProcessCreation · test · high · {"category":"process_creation","product":"windows"}
• Permission Check Via Accesschk.EXE · test · medium · {"product":"windows","category":"process_creation"}
• Local Groups Reconnaissance Via Wmic.EXE · test · low · {"product":"windows","category":"process_creation"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0114 Behavioral Detection of Local Group Enumeration Across OS Platforms

AN0317 Analytic 0317

Detects attempts to enumerate local groups via Net.exe, PowerShell, or native API calls that precede lateral movement or privilege abuse.

AN0318 Analytic 0318

Detects enumeration of local groups using common binaries (groups, getent, cat /etc/group) or scripting with suspicious lineage.

AN0319 Analytic 0319

Detects use of dscl or id/group commands to enumerate local system groups, often by post-exploitation tools or persistence checks.