T1069.002 — Domain Groups

Tactic: Discovery · Platforms: Linux, macOS, Windows

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated…

Sub-technique of Permission Groups Discovery (T1069).

Sigma detection rules (3)

T1069.002 Permission Groups Discovery: Domain Groups

title: "T1069.002 Permission Groups Discovery: Domain Groups"
id: 98cbaa7f-249e-48bd-a9ce-655c4b5a9aa4
description: 'Behavioral Detection of Domain Group Discovery. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: TimeWindow, UserContext, ProcessLineageDepth.'
references:
  - https://attack.mitre.org/techniques/T1069/002
author: Shahrukh Khan
date: 2026-01-17
license: MIT
tags:
  - attack.discovery
  - attack.t1069.002

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains|all:
      - 'group'
      - '/domain'

  condition: selection

falsepositives:
  - Routine domain group enumeration by IT/helpdesk tooling and login scripts.

level: informational

T1069.002 Permission Groups Discovery: Domain Groups

title: "T1069.002 Permission Groups Discovery: Domain Groups"
id: c222374b-76d9-417c-ba1e-b9a1e298915e
description: 'Behavioral Detection of Domain Group Discovery. The prior condition (1 of selection*) let the unconstrained base selection fire on any ldapsearch/wbinfo execution regardless of arguments, making the more specific wbinfo -g check redundant and leaving the rule matching non-group operations like wbinfo -u. Now requires wbinfo to carry -g, or ldapsearch to reference a group-objectClass filter, before matching. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: LDAPQueryDepth, CommandPattern.'
references:
  - https://attack.mitre.org/techniques/T1069/002
author: Shahrukh Khan
date: 2026-01-11
license: MIT
tags:
  - attack.discovery
  - attack.t1069.002

logsource:
  category: process_creation
  product: linux

detection:
  selection_wbinfo:
    type: EXECVE
    a0|endswith: '/wbinfo'
    a1|contains: '-g'
  selection_ldapsearch:
    type: EXECVE
    a0|endswith: '/ldapsearch'
    a1|contains: 'objectClass=group'

  condition: 1 of selection_*

falsepositives:
  - ldapsearch/wbinfo are used by legitimate directory-integration scripts and identity management tooling; volume and off-hours timing are needed to separate recon from routine sync jobs.

level: low

T1069.002 Permission Groups Discovery: Domain Groups

title: "T1069.002 Permission Groups Discovery: Domain Groups"
id: dfde74f8-5320-484e-914e-fcb2e9088262
description: 'Behavioral Detection of Domain Group Discovery. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CommandSignatureThreshold, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1069/002
author: Shahrukh Khan
date: 2026-01-17
license: MIT
tags:
  - attack.discovery
  - attack.t1069.002

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/dscl'
    CommandLine|contains: '/Active Directory/'
  selection_alt:
    Image|endswith: '/dsconfigad'
    CommandLine|contains: '-show'
  condition: 1 of selection*

falsepositives:
  - IT administrators auditing Active Directory group binding on domain-joined Macs, which is uncommon in most modern macOS fleets.

level: informational

Related sub-techniques

Explore