MITRE ATT&CK Technique
T1069Permission Groups Discovery
- First Reported
- May 12, 2026
- Latest Reported
- May 12, 2026
Official Description
Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions.
Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.(Citation: CrowdStrike BloodHound April 2018)
Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.(Citation: CrowdStrike BloodHound April 2018)
- Tactics
- Discovery
- Platforms
- Containers, IaaS, Identity Provider, Linux, macOS, Office Suite, SaaS, Windows
- MITRE Version
- 2.6
- Last Modified
- Oct 24, 2025
Sub-techniques (3)
Reported Context (1)
- The article's mapping identifies net group enumeration in the intrusion toolkit. CVE-2025-32975 KACE SMA Breach Revealed HIQ Data and 60+ Downstream Clients
CVE (3)
MITRE ATT&CK (20)
Vendors (2)
Products (7)
Tools (13)
Industries (7)
Countries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.