Detect Permission Groups Discovery in Sumo Logic CSE
Adversaries may attempt to discover group and permission settings to understand which user accounts and groups are available, group memberships, and which users and groups have elevated permissions. This information informs targeting decisions and enables privilege escalation, lateral movement, and persistence planning. Common enumeration methods include native Windows commands (net group, net localgroup), PowerShell cmdlets (Get-ADGroup, Get-LocalGroup), LDAP queries, BloodHound/SharpHound collection, Linux identity commands (id, groups, getent group), and cloud-provider APIs. Threat actors including APT41, TA505, Volt Typhoon, and Scattered Spider have used these techniques in real-world intrusions.
MITRE ATT&CK
- Tactic
- Discovery
- Technique
- T1069 Permission Groups Discovery
- Canonical reference
- https://attack.mitre.org/techniques/T1069/
Sumo Detection Query
_sourceCategory=*windows* OR _sourceCategory=*sysmon* OR _sourceCategory=*endpoint*
| where _raw matches /(?i)(EventCode=1|EventCode=4688|event_id=1|event_id=4688)/
| parse field=_raw "Image=*" as Image nodrop
| parse field=_raw "NewProcessName=*" as NewProcessName nodrop
| parse field=_raw "CommandLine=*" as CommandLine nodrop
| parse field=_raw "ProcessCommandLine=*" as ProcessCommandLine nodrop
| parse field=_raw "ParentImage=*" as ParentImage nodrop
| parse field=_raw "ParentProcessName=*" as ParentProcessName nodrop
| parse field=_raw "User=*" as User nodrop
| parse field=_raw "Computer=*" as Computer nodrop
| eval process_image = if(!isEmpty(Image), Image, NewProcessName)
| eval cmd_line = if(!isEmpty(CommandLine), CommandLine, ProcessCommandLine)
| eval parent_image = if(!isEmpty(ParentImage), ParentImage, ParentProcessName)
| eval lower_image = toLowerCase(process_image)
| eval lower_cmd = toLowerCase(cmd_line)
| where (
(matches(lower_image, ".*\\\\net\.exe$") OR matches(lower_image, ".*\\\\net1\.exe$"))
AND (matches(lower_cmd, ".*group.*") OR matches(lower_cmd, ".*localgroup.*"))
) OR (
(matches(lower_image, ".*\\\\powershell\.exe$") OR matches(lower_image, ".*\\\\pwsh\.exe$"))
AND matches(lower_cmd, ".*(get-adgroup|get-adgroupmember|get-localgroup|get-localgroupmember|get-adprincipalgroupmembership).*")
) OR (
(matches(lower_image, ".*\\\\dsquery\.exe$") OR matches(lower_image, ".*\\\\dsget\.exe$"))
AND matches(lower_cmd, ".*group.*")
) OR (
matches(lower_image, ".*\\\\whoami\.exe$")
AND matches(lower_cmd, ".*/groups.*|.*/all.*|.*/priv.*")
) OR (
matches(lower_image, ".*\\\\gpresult\.exe$")
) OR (
matches(lower_cmd, ".*(sharphound|bloodhound|-collectionmethod|--collectionmethods).*")
)
| eval IsDomainGroupQuery = if(matches(lower_cmd, ".*/domain.*|.*net group.*|.*dsquery group.*|.*get-adgroup.*"), 1, 0)
| eval IsLocalGroupQuery = if(matches(lower_cmd, ".*localgroup.*|.*get-localgroup.*|.*whoami /groups.*"), 1, 0)
| eval IsBloodHound = if(matches(lower_cmd, ".*(sharphound|bloodhound|-collectionmethod).*"), 1, 0)
| eval SuspiciousParent = if(matches(toLowerCase(parent_image), ".*(wscript|cscript|mshta|rundll32|regsvr32).*"), 1, 0)
| fields _messageTime, Computer, User, process_image, cmd_line, parent_image, IsDomainGroupQuery, IsLocalGroupQuery, IsBloodHound, SuspiciousParent
| sort by _messageTime descSumo Logic query detecting MITRE T1069 Permission Groups Discovery by parsing Windows Security (EventCode 4688) and Sysmon process creation events. Identifies group enumeration via net.exe, PowerShell AD/local group cmdlets, dsquery/dsget LDAP tools, whoami privilege queries, gpresult, and BloodHound/SharpHound collectors. Each event is enriched with classification flags indicating the type of group query and whether a suspicious parent process initiated the activity.
Data Sources
Required Tables
False Positives & Tuning
- System administrators performing routine AD group membership reviews or compliance checks using Get-ADGroup and related PowerShell cmdlets from management workstations
- Help desk technicians running gpresult or whoami /all to troubleshoot GPO application or access permission issues for end users
- Automated discovery agents from CyberArk, BeyondTrust, or similar PAM solutions enumerating privileged group memberships during account vaulting
- Red team or penetration testing exercises using BloodHound/SharpHound with documented authorization and scope agreements
Other platforms for T1069
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Local Group Enumeration via net.exe
Expected signal: Sysmon Event ID 1: Two Process Create events for net.exe (or net1.exe, which net.exe spawns internally). CommandLine values: 'net localgroup' and 'net localgroup Administrators'. Security Event ID 4688 if command line auditing is enabled. Parent process will be cmd.exe or the shell used to execute the commands.
- Test 2Domain Group Enumeration via net.exe
Expected signal: Sysmon Event ID 1: Process Create for net.exe with CommandLine 'net group /domain' and 'net group "Domain Admins" /domain'. Network connection to domain controller on port 389 (LDAP) or 445 (SMB SAMR protocol). On the domain controller: Security Event ID 4661/4662 may fire for SAM group object access.
- Test 3PowerShell Active Directory Group Enumeration
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Get-ADGroup' and 'Get-ADGroupMember'. PowerShell ScriptBlock Log Event ID 4104 capturing the full script content. LDAP network traffic to domain controller on port 389/636.
- Test 4whoami Group Membership Query
Expected signal: Sysmon Event ID 1: Two Process Create events for whoami.exe. CommandLine values: 'whoami /groups' and 'whoami /all'. No network traffic (local token query). Output includes SID values, group names, and enabled privileges — this data is often captured via screen scraping in interactive sessions.
- Test 5Linux Group Discovery via id and getent
Expected signal: Linux auditd: syscall execve events for /usr/bin/id, /usr/bin/groups, /usr/bin/getent with respective arguments. Syslog entries if exec auditing is enabled. On systems with osquery or EDR agents: process creation events for each command with full argument lists.
References (11)
- https://attack.mitre.org/techniques/T1069/
- https://attack.mitre.org/techniques/T1069/001/
- https://attack.mitre.org/techniques/T1069/002/
- https://attack.mitre.org/techniques/T1069/003/
- https://www.crowdstrike.com/blog/hidden-administrative-accounts-bloodhound-to-the-rescue/
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/net-group
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.002/T1069.002.md
- https://github.com/BloodHoundAD/BloodHound
- https://www.mandiant.com/resources/blog/apt41-initiates-global-intrusion-campaign-using-multiple-exploits
Unlock Pro Content
Get the full detection package for T1069 including response playbook, investigation guide, and atomic red team tests.