Detection rules › Splunk
Permission Groups Discovery: Domain Groups (Windows Event Log)
Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Discovery | T1069.002 Permission Groups Discovery: Domain Groups |
References
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.002/T1069.002.md#atomic-test-1---basic-permission-groups-discovery-windows-domain
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.002/T1069.002.md#atomic-test-2---permission-groups-discovery-powershell-domain
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.002/T1069.002.md#atomic-test-3---elevated-group-enumeration-using-net-group-domain
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '16633.25779'
title: 'Permission Groups Discovery: Domain Groups'
description: 'Adversaries may attempt to find domain-level groups and permission settings.
The knowledge of domain-level permission groups can help adversaries determine which
groups exist and which users belong to a particular group. Adversaries may use this
information to determine which users have elevated permissions, such as domain administrators.
-- Threat Actor Association: Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE
PRESIDENT/TA416/RedDelta) - Software Association: Akira, Rhysida -- Atomics T1069.001
Test #2 Atomics T1069.002 Test #1 Atomics T1069.002 Test #2 Atomics T1069.002 Test
#3 Atomics T1069.002 Test #9 Atomics T1069.002 Test #10'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process) TERM(get-ADPrincipalGroupMembership) OR TERM(Get-ADGroup)
OR "objectcategory=group" OR "adsisearcher" OR "adfind" OR (TERM(net) AND (TERM(localgroup)
OR ("group" AND "doma"))) OR (TERM(localgroup) OR ("group" AND "doma")) | regex
process="(?i)\s+(localgroup|group(s?)\s+.*doma)|Get-AD(PrincipalGroupMembership|Group)|objectcategory=group"
| table _time, host, user, process, process_*, parent_process* | bin span=1s | stats
values(*) as * by _time, host '
techniques:
- discovery:permission groups discovery:domain groups
- discovery:permission groups discovery
technique_id:
- T1069.002
- T1069
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.002/T1069.002.md#atomic-test-1---basic-permission-groups-discovery-windows-domain
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.002/T1069.002.md#atomic-test-2---permission-groups-discovery-powershell-domain
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.002/T1069.002.md#atomic-test-3---elevated-group-enumeration-using-net-group-domain
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) TERM(get-ADPrincipalGroupMembership) OR TERM(Get-ADGroup) OR "objectcategory=group" OR "adsisearcher" OR "adfind" OR (TERM(net) AND (TERM(localgroup) OR ("group" AND "doma"))) OR (TERM(localgroup) OR ("group" AND "doma"))
Stage 2: regex
| regex process="(?i)\s+(localgroup|group(s?)\s+.*doma)|Get-AD(PrincipalGroupMembership|Group)|objectcategory=group"
Stage 3: table
| table _time, host, user, process, process_*, parent_process*
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | "get-ADPrincipalGroupMembership" |
| 1 | "Get-ADGroup" |
| 1 | "objectcategory=group" |
| 1 | "adsisearcher" |
| 1 | "adfind" |
| 1 | TERM |
| 1 | net |
| 1 | TERM |
| 1 | localgroup |
| 1 | "group" |
| 1 | "doma" |
| 1 | TERM |
| 1 | localgroup |
| 1 | "group" |
| 1 | "doma" |