216.73.216.6

T1069.002: T1069.002

View on MITRE ATT&CK The MITRE Corporation · Published 21/02/2020 22:15 · Modified 20/04/2026 12:52

Essential information

MITRE technique ID
T1069.002
Confidence
100/100
Revoked
No
Published
21/02/2020 22:15
Modified
20/04/2026 12:52
Author / Source
The MITRE Corporation

Aliases

Domain Groups

Platforms

windows macos linux

Description

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators. Commands such as `net group /domain` of the [Net](https://attack.mitre.org/software/S0039) utility, `dscacheutil -q group` on macOS, and `ldapsearch` on Linux can list domain-level groups.

Kill chain phases

Kill chainPhase
mitre-attack discovery

Marking (TLP)

TLP:GREEN Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.

External references

Related entities

Intrusion sets, malware, reports, vulnerabilities, indicators and other entities linked to this technique.