Permission Groups Discovery: Domain Groups

Active Directory organizes users into groups, both to manage permissions and to reflect organizational structure. Domain groups discovery is the act of enumerating those groups and their members, using nothing more exotic than the built-in tools any administrator would already have.

Every organization has legitimate reasons for this activity to happen constantly: onboarding, access reviews, troubleshooting permissions. That's what makes it a genuinely useful early-stage technique for an attacker too, since the tools involved raise no alarms on their own.

Once an attacker has any foothold, however limited, enumerating domain groups tells them who has access to what before they commit to a next move. Built-in commands like net group, PowerShell's Active Directory cmdlets, or LDAP queries all return this information to any authenticated account, with no exploit required.

The goal is usually mapping a path toward a specific privileged group, such as Domain Admins, so the attacker knows which accounts are worth targeting next. This is reconnaissance, not compromise on its own, but it's frequently the step that turns a foothold into a plan.

Data source: endpoint process-creation telemetry, or directory-service query logs where available

{
  "host": {
    "name": "example-host"
  },
  "user": {
    "name": "j.doe"
  },
  "event": {
    "type": "start",
    "category": "process"
  },
  "process": {
    "name": "net.exe",
    "command_line": "net group \"Domain Admins\" /domain"
  }
}

Prebuilt Elastic rule: Windows Account or Group Discovery

Filter process-creation events for net.exe, net1.exe, or PowerShell invoking Active Directory cmdlets, then look specifically for domain-scoped arguments rather than purely local ones. A single query is unremarkable; a sequence probing several groups in quick succession, especially from an account or host with no administrative reason to care, is a stronger pattern.

Correlating with what happens immediately afterward matters too: enumeration followed by an authentication attempt against a newly-discovered privileged account is a much stronger story than either event alone.

Administrators, help desk staff, and a wide range of legitimate automation query group membership constantly as part of ordinary operations. The presence of a group-enumeration command, by itself, is close to meaningless.

The distinguishing signal is context: who ran it, whether that account has any ordinary reason to be querying domain groups, and what happened immediately before and after. An identity and access management tool running this on a schedule is routine; the same query from a workstation account with no administrative role, especially shortly after an unusual login, is not.

• MITRE ATT&CK: T1069.002 Permission Groups Discovery: Domain Groups
• Elastic Security: Windows Account or Group Discovery

1 scenario in this catalog covers T1069.002. We don't name it — identifying the technique is part of what a scenario grades. Explore the dashboard →