T1069 Permission Groups Discovery — Attack Simulation

DC0064 collection page — Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.

Providers and collection configuration

• PowerShell Script Block Logging: Script content via event 4104 when configured; channel depends on PowerShell edition.
• Sysmon process events: Interpreter launch and parent context, not full script content.
• Linux Audit: execve-family execution context; shell built-ins need additional instrumentation.

• Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.
• Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.
• On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records.

Required normalized fields: interpreter, command_line, actor_uid, session_id.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0064",
  "collector": "illustrative-lab-collector",
  "observation": {
    "interpreter": "/bin/sh",
    "command_line": "printf LAB_TELEMETRY_CHECK",
    "actor_uid": 1000,
    "session_id": "lab-session-1"
  }
}

Visibility limits: Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.

DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, image, parent_image, command_line, user.

<EventFiltering>
  <ProcessCreate onmatch="include">
    <Image condition="is">C:\Windows\System32\whoami.exe</Image>
  </ProcessCreate>
</EventFiltering>

This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0032",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "image": "C:\\Windows\\System32\\whoami.exe",
    "parent_image": "C:\\Windows\\System32\\cmd.exe",
    "command_line": "whoami",
    "user": "LAB\\analyst"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

MITRE detection strategy

3 exact-tagged source rules. A source tag is a discovery aid, not a relevance verdict. Check the observation point and actual condition of each rule.

• Malicious PowerShell Commandlets - PoshModule — test; product: windows; category: ps_module; definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b.
• Malicious PowerShell Commandlets - ScriptBlock — test; product: windows; category: ps_script; definition: Requirements: Script Block Logging must be enabled.
• Malicious PowerShell Commandlets - ProcessCreation — test; category: process_creation; product: windows.

• S0233 MURKYTOP — malware.

  MURKYTOP has the capability to retrieve information about groups.[FireEye Periscope March 2018]

  Exact relationship: relationship--975739e9-bb45-49d6-a67f-bc770845b4bf
• S0266 TrickBot — malware.

  TrickBot can identify the groups the user on a compromised host belongs to.[Cyberreason Anchor December 2019]

  Exact relationship: relationship--887d8bb3-1bd5-4010-81dc-fe479690e72d
• S0335 Carbon — malware.

  Carbon uses the <code>net group</code> command.[GovCERT Carbon May 2016]

  Exact relationship: relationship--3bda9db3-3532-429c-86a4-8ff3ee32f59f
• S0445 ShimRatReporter — tool.

  ShimRatReporter gathered the local privileges for the infected host.[FOX-IT May 2016 Mofang]

  Exact relationship: relationship--c403720d-da66-45c4-bb35-93b3b35c87c3
• S0483 IcedID — malware.

  IcedID has the ability to identify Workgroup membership.[IBM IcedID November 2017]

  Exact relationship: relationship--34a06e23-b81c-45c7-96bc-7e08d31a4a44
• S0623 Siloscape — malware.

  Siloscape checks for Kubernetes node permissions.[Unit 42 Siloscape Jun 2021]

  Exact relationship: relationship--e869a744-8bc5-4c01-960f-11e850a5c38e