Detection rules › Splunk
Permission Groups Discovery: Local Groups (Windows Event Log)
Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Discovery | T1069 Permission Groups Discovery |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '16743.26343'
title: 'Permission Groups Discovery: Local Groups'
description: 'Adversaries may attempt to find local system groups and permission settings.
The knowledge of local system permission groups can help adversaries determine which
groups exist and which users belong to a particular group. Adversaries may use this
information to determine which users have elevated permissions, such as the users
found within the local administrators group. Atomics T1069.001 Test #3 Atomics T1069.001
Test #5 Atomics T1069.001 Test #6'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process) TERM(Get-LocalGroup) OR TERM(Get-LocalGroupMember)
OR (("wmic" OR TERM(Get-WMIObject) AND TERM(group))) | table _time, host, user,
process, process_*, parent_process | bin span=1s | stats values(*) as * by _time,
host '
techniques:
- discovery:permission groups discovery
technique_id:
- T1069
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md#atomic-test-3---permission-groups-discovery-powershell-local
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) TERM(Get-LocalGroup) OR TERM(Get-LocalGroupMember) OR (("wmic" OR TERM(Get-WMIObject) AND TERM(group)))
Stage 2: table
| table _time, host, user, process, process_*, parent_process
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | "Get-LocalGroup" |
| 1 | "Get-LocalGroupMember" |
| 1 | "wmic" |
| 1 | "Get-WMIObject" |
| 1 | TERM |
| 1 | group |