T1069.001 — Local Groups

Tactic: Discovery · Platforms: Linux, macOS, Windows

Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated…

Sub-technique of Permission Groups Discovery (T1069).

Sigma detection rules (3)

T1069.001 Permission Groups Discovery: Local Groups

title: "T1069.001 Permission Groups Discovery: Local Groups"
id: d1f14bc7-87ea-434c-bbbe-721f8c15a54d
description: 'Behavioral Detection of Local Group Enumeration Across OS Platforms. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: TimeWindow, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1069/001
author: Shahrukh Khan
date: 2026-01-26
license: MIT
tags:
  - attack.discovery
  - attack.t1069.001

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains: 'localgroup'

  condition: selection

falsepositives:
  - Routine local-group-membership review by IT and security teams.

level: informational

T1069.001 Permission Groups Discovery: Local Groups

title: "T1069.001 Permission Groups Discovery: Local Groups"
id: 7c92bcc3-9a12-441b-878c-0ea875d7aff4
description: 'Behavioral Detection of Local Group Enumeration Across OS Platforms, including the groups command itself alongside cat/getent of /etc/group. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ProcessName, ParentProcess.'
references:
  - https://attack.mitre.org/techniques/T1069/001
author: Shahrukh Khan
date: 2026-04-22
license: MIT
tags:
  - attack.discovery
  - attack.t1069.001

logsource:
  category: process_creation
  product: linux

detection:
  selection_file:
    type: EXECVE
    a0|endswith:
      - '/cat'
      - '/getent'
    a1|contains: '/etc/group'
  selection_groups:
    type: EXECVE
    a0|endswith: '/groups'

  condition: 1 of selection_*

falsepositives:
  - Reading /etc/group or running groups is a common, benign administrative and monitoring-agent action.

level: informational

T1069.001 Permission Groups Discovery: Local Groups

title: "T1069.001 Permission Groups Discovery: Local Groups"
id: 4c32f3e9-88c8-4b72-bb00-9d0c952a7662
description: 'Behavioral Detection of Local Group Enumeration Across OS Platforms. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CommandLineContains, InteractiveSession.'
references:
  - https://attack.mitre.org/techniques/T1069/001
author: Shahrukh Khan
date: 2026-06-18
license: MIT
tags:
  - attack.discovery
  - attack.t1069.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/dscl'
    CommandLine|contains: '/Groups'
  selection_alt:
    Image|endswith: '/groups'
  condition: 1 of selection*

falsepositives:
  - Standard shell scripts or login profiles that enumerate local group membership.

level: informational

Related sub-techniques

Explore