Which SIEM platforms have a T1069.002 detection rule?

df00tech provides T1069.002 (Domain Groups) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Domain Groups (T1069.002)?

Detecting Domain Groups requires the following data sources: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint.

What severity and confidence is the T1069.002 detection?

The T1069.002 detection is rated medium severity with high confidence.

What are common false positives for T1069.002?

Common false positives for T1069.002 include: IT administrators running legitimate Active Directory audits or health checks using net group or PowerShell AD cmdlets; Helpdesk staff using AD management tools to look up group memberships when resolving user access issues; Monitoring and SIEM agents (e.g., Microsoft Defender for Identity, CrowdStrike Falcon) performing scheduled AD enumeration as part of their normal operation.

T1069.002 IBM QRadar · QRadar

Detect Domain Groups in IBM QRadar

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators. Commands such as net group /domain, dscacheutil -q group on macOS, and ldapsearch on Linux can list domain-level groups. Tools such as BloodHound, AdFind, and AD Explorer are also commonly used for this purpose by threat actors including OilRig, FIN7, Volt Typhoon, LAPSUS$, and ToddyCat.

MITRE ATT&CK

Tactic: Discovery
Technique: T1069 Permission Groups Discovery
Sub-technique: T1069.002 Domain Groups
Canonical reference: https://attack.mitre.org/techniques/T1069/002/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  LOGSOURCENAME(logsourceid) AS LogSource,
  LOGSOURCETYPENAME(devicetype) AS LogSourceType,
  sourceip AS SourceIP,
  username AS UserName,
  "devicehostname" AS Hostname,
  "Image" AS ProcessImage,
  "CommandLine" AS CommandLine,
  "ParentImage" AS ParentProcess,
  QIDNAME(qid) AS EventName,
  CASE
    WHEN LOWER("Image") LIKE '%\\net.exe' OR LOWER("Image") LIKE '%\\net1.exe' THEN 'net group /domain'
    WHEN LOWER("Image") LIKE '%\\powershell.exe' OR LOWER("Image") LIKE '%\\pwsh.exe' THEN 'PowerShell AD Enumeration'
    WHEN LOWER("Image") LIKE '%adfind.exe' OR LOWER("Image") LIKE '%sharphound.exe' OR LOWER("Image") LIKE '%bloodhound.exe' THEN 'Known AD Enumeration Tool'
    WHEN LOWER("Image") LIKE '%\\dsquery.exe' OR LOWER("Image") LIKE '%\\dsget.exe' THEN 'dsquery/dsget group'
    ELSE 'Unknown'
  END AS DetectionMethod,
  CASE
    WHEN LOWER("CommandLine") LIKE '%domain admins%'
      OR LOWER("CommandLine") LIKE '%enterprise admins%'
      OR LOWER("CommandLine") LIKE '%schema admins%'
      OR LOWER("CommandLine") LIKE '%domain controllers%'
      OR LOWER("CommandLine") LIKE '%group policy creator%'
    THEN 1 ELSE 0
  END AS TargetingPrivilegedGroup
FROM events
WHERE
  LOGSOURCETYPEID IN (12, 13, 191, 396)
  AND (
    (
      (LOWER("Image") LIKE '%\\net.exe' OR LOWER("Image") LIKE '%\\net1.exe')
      AND LOWER("CommandLine") LIKE '% group %'
      AND (
        LOWER("CommandLine") LIKE '%/domain%' OR
        LOWER("CommandLine") LIKE '%domain admins%' OR
        LOWER("CommandLine") LIKE '%enterprise admins%' OR
        LOWER("CommandLine") LIKE '%schema admins%' OR
        LOWER("CommandLine") LIKE '%domain controllers%' OR
        LOWER("CommandLine") LIKE '%group policy%'
      )
    ) OR (
      (LOWER("Image") LIKE '%\\powershell.exe' OR LOWER("Image") LIKE '%\\pwsh.exe')
      AND (
        LOWER("CommandLine") LIKE '%get-adgroup%' OR
        LOWER("CommandLine") LIKE '%get-adgroupmember%' OR
        LOWER("CommandLine") LIKE '%get-domaingroup%' OR
        LOWER("CommandLine") LIKE '%get-netgroup%' OR
        LOWER("CommandLine") LIKE '%directorysearcher%' OR
        LOWER("CommandLine") LIKE '%objectclass=group%' OR
        LOWER("CommandLine") LIKE '%samaccounttype%'
      )
    ) OR
      LOWER("Image") LIKE '%adfind.exe' OR
      LOWER("Image") LIKE '%sharphound.exe' OR
      LOWER("Image") LIKE '%bloodhound.exe' OR
      LOWER("Image") LIKE '%adexplorer.exe' OR
      LOWER("Image") LIKE '%adexplorer64.exe'
    OR (
      (LOWER("Image") LIKE '%\\dsquery.exe' OR LOWER("Image") LIKE '%\\dsget.exe')
      AND LOWER("CommandLine") LIKE '% group%'
    )
  )
ORDER BY starttime DESC
LAST 24 HOURS

medium severity high confidence

Detects T1069.002 domain group enumeration in IBM QRadar using AQL against Windows process execution events from Sysmon (EventCode 1) and Security audit logs (EventCode 4688). Covers net group /domain, PowerShell AD group cmdlets, known tools such as AdFind, SharpHound, and BloodHound, and dsquery/dsget group commands. LOGSOURCETYPEID values 12/13 are Microsoft Windows Security Event Log and Sysmon respectively; adjust for your environment's log source IDs.

Data Sources

Microsoft Windows Security Event Log (EventCode 4688)Sysmon Operational Log (EventCode 1)QRadar DSM for Microsoft WindowsQRadar DSM for Sysmon

Required Tables

events

False Positives & Tuning

Active Directory auditing scripts run by IT operations that enumerate domain groups for compliance reporting or ITSM change management workflows
Enterprise identity governance platforms (SailPoint, Saviynt, One Identity) that regularly query domain group membership to detect toxic combinations and certify access
Helpdesk automation tools running PowerShell Get-ADGroup against a service account to display user group memberships during password reset or access request workflows
Security scanning platforms (Tenable.ad, Semperis) legitimately enumerating group memberships for attack path analysis and exposure scoring

Download portable Sigma rule (.yml)

Other platforms for T1069.002

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Net Group Domain Admin Enumeration
Expected signal: Sysmon Event ID 1: Process Create with Image=net.exe or net1.exe, CommandLine containing 'group' and '/domain'. Security Event ID 4688 (if command line auditing is enabled). On the domain controller, Security Event ID 4661 may appear if SACL auditing is configured on Domain Admins group object.
Test 2PowerShell Active Directory Module Group Enumeration
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-ADGroup' and 'Get-ADGroupMember'. Sysmon Event ID 3: LDAP network connections (port 389 or 3268) from powershell.exe to domain controller IP. PowerShell ScriptBlock Log Event ID 4104 with the full command. Sysmon Event ID 11: File creation event for groups_out.txt in %TEMP%.
Test 3AdFind Domain Group Enumeration
Expected signal: Sysmon Event ID 1: Process Create with Image=AdFind.exe, CommandLine containing '-f' and 'objectClass=group'. Sysmon Event ID 3: Network connections from AdFind.exe to domain controller on LDAP port 389 or Global Catalog port 3268. Sysmon Event ID 11: Output files created in %TEMP%. Prefetch file created at C:\Windows\Prefetch\ADFIND.EXE-*.pf.
Test 4dsquery Group Enumeration
Expected signal: Sysmon Event ID 1: Process Create with Image=dsquery.exe and Image=dsget.exe, CommandLine containing 'group'. Security Event ID 4688 if command line auditing is enabled. Sysmon Event ID 3: LDAP connections (port 389) from dsquery.exe to domain controller.

Last updated: 2026-04-17 Research depth: deep

References (11)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1069.002 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Domain Groups in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1069.002

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Discovery

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1069.002

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Discovery

Popular Detections

Get new detections in your inbox