T1069: Permission Groups Discovery
Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions.
Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.[1]
Analyst context for executives and security teams
Permission Groups Discovery is often an early “map the privileges” behavior: an intruder with some access looks for which local, domain, cloud, SaaS, identity-provider, or container groups exist and who has elevated permissions. For leaders, the risk is not the lookup itself; it is that this knowledge can guide follow-on targeting of administrators, privileged groups, and high-value systems.
Executive priority
Treat this as a control-validation issue for identity governance, cloud administration, and SOC readiness. Security leaders should ask whether privileged group membership is minimized, reviewed, and logged across endpoint, directory, cloud, SaaS, Office Suite, identity provider, and container environments. Because ATT&CK lists use by multiple groups, malware, and the SolarWinds Compromise campaign, this behavior has broad defensive relevance, but local exposure and priority depend on the organization’s identity architecture and telemetry coverage.
Technical view
This is a Discovery technique spanning Containers, IaaS, Identity Provider, Linux, macOS, Office Suite, SaaS, and Windows. Validate coverage separately for the subtechnique areas: local groups, domain groups, and cloud groups. ATT&CK does not provide official detection text for T1069, but a related detection strategy, DET0179 Behavioral Detection of Permission Groups Discovery, is linked. SOC and IR teams should baseline legitimate administrative group lookups and investigate unusual enumeration by non-admin users, newly compromised accounts, service accounts, endpoint processes, cloud sessions, or container workloads.
Likely telemetry
- Endpoint process creation and command-line telemetry on Windows, Linux, and macOS for group and permission enumeration activity
- Local system logs showing group membership queries or administrative tool execution where available
- Directory or domain authentication and audit logs for group membership and privileged group discovery
- Identity provider audit logs for role, group, and membership queries
- SaaS, Office Suite, and IaaS audit logs for administrative role and group listing activity
Detection direction
- Confirm whether DET0179 or equivalent behavioral analytics are implemented and mapped to T1069, T1069.001, T1069.002, and T1069.003.
- Tune for context: group discovery by administrators, inventory tools, and helpdesk workflows may be normal; group discovery by unusual users, newly created sessions, compromised endpoints, or unexpected cloud principals is higher value.
- Correlate enumeration with preceding access events and follow-on attempts to access privileged accounts, groups, cloud roles, or administrative systems.
- Check blind spots across cloud and identity provider logs; endpoint-only monitoring will miss SaaS, Office Suite, IaaS, and identity-provider group discovery.
- For container environments, validate audit visibility into authorization and RBAC-related queries rather than assuming host EDR covers Kubernetes-level permission discovery.
Mitigation priorities
- Prioritize least-privilege design and regular review of local, domain, cloud, SaaS, Office Suite, identity-provider, and container group memberships.
- Reduce unnecessary standing membership in elevated groups and ensure privileged groups have clear ownership and review evidence for compliance readiness.
- Limit who can enumerate sensitive group or role membership where the platform supports it, while preserving required administrative operations.
- Ensure centralized logging for identity, cloud, SaaS, endpoint, and container control planes so discovery behavior can be reconstructed during incident response.
- Use the technique and its subtechniques to test detection engineering assumptions during purple-team or control-validation exercises.
Analyst notes and limits
The materiality of this technique comes from how it enables targeting decisions after initial access or credential compromise. The relationship set shows relevance across local, domain, and cloud group discovery, and ATT&CK links the behavior to multiple groups, software entries, and the SolarWinds Compromise campaign. Use those relationships as prioritization context, not as proof of current activity in any environment.
ATT&CK provides no official detection text for this object, and the supplied relationship descriptions are partial for some subtechniques and actors. This take does not establish active exploitation, attribution, or detection coverage. Local platform configuration, audit policy, identity architecture, and log retention are required to determine actual risk and visibility.
Permission Groups Discovery
Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions.
Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.[1]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1069.003 | Cloud Groups Sub-technique | Cloud Groups subtechnique of this object. |
| Enterprise | T1069.002 | Domain Groups Sub-technique | Domain Groups subtechnique of this object. |
| Enterprise | T1069.001 | Local Groups Sub-technique | Local Groups subtechnique of this object. |
Groups, software, and campaigns
G0096: APT41
APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.[1] Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.[2][3]
G1015: Scattered Spider
Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. [1] [2] The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. [2] Scattered Spider relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain. [3] [4] [5] Scattered Spider had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365. [6]
G0092: TA505
G1017: Volt Typhoon
Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. Volt Typhoon's targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. Volt Typhoon has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.[1][2][3][4]. The group has leveraged compromised SOHO routers to proxy command and control traffic and obscure its infrastructure, activity associated with the KV botnet.[5].
Reporting indicates a separate initial access cluster, SYLVANITE, has been observed exploiting internet-facing edge devices and transferring access to Volt Typhoon, also tracked as VOLTZITE, for follow-on operations. [6]
G0022: APT3
APT3 is a China-based threat group that researchers have attributed to China's Ministry of State Security.[1][2] This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap.[1][3] As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong.[4]
G1016: FIN13
S0483: IcedID
S0335: Carbon
S0266: TrickBot
TrickBot is a Trojan spyware program written in C++ that first emerged in September 2016 as a possible successor to Dyre. TrickBot was developed and initially used by Wizard Spider for targeting banking sites in North America, Australia, and throughout Europe; it has since been used against all sectors worldwide as part of "big game hunting" ransomware campaigns.[1][2][3][4]
S0233: MURKYTOP
S0445: ShimRatReporter
ShimRatReporter is a tool used by suspected Chinese adversary Mofang to automatically conduct initial discovery. The details from this discovery are used to customize follow-on payloads (such as ShimRat) as well as set up faux infrastructure which mimics the adversary's targets. ShimRatReporter has been used in campaigns targeting multiple countries and sectors including government, military, critical infrastructure, automobile, and weapons development.[1]
S0623: Siloscape
C0024: SolarWinds Compromise
The SolarWinds Compromise was a sophisticated supply chain cyber operation conducted by APT29 that was discovered in mid-December 2020. APT29 used customized malware to inject malicious code into the SolarWinds Orion software build process that was later distributed through a normal software update; they also used password spraying, token theft, API abuse, spear phishing, and other supply chain attacks to compromise user accounts and leverage their associated access. Victims of this campaign included government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East. This activity has been labled the StellarParticle campaign in industry reporting.[1] Industry reporting also initially referred to the actors involved in this campaign as UNC2452, NOBELIUM, Dark Halo, and SolarStorm.[2][3][4][5][1][6][7][8]
In April 2021, the US and UK governments attributed the SolarWinds Compromise to Russia's Foreign Intelligence Service (SVR); public statements included citations to APT29, Cozy Bear, and The Dukes.[9][10][11] The US government assessed that of the approximately 18,000 affected public and private sector customers of Solar Winds’ Orion product, a much smaller number were compromised by follow-on APT29 activity on their systems.[12]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 2.6 | Current bundle | 8dffc3149710… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
CrowdStrike BloodHound April 2018
Red Team Labs. (2018, April 24). Hidden Administrative Accounts: BloodHound to the Rescue. Retrieved October 28, 2020.
Open source URL -
[2]
K8s Authorization Overview
Kubernetes. (n.d.). Authorization Overview. Retrieved June 24, 2021.
Open source URL -
[3]
mitre-attack T1069Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.