ATT&CK technique

T1069.001

Local Groups

Discovery 36 detections found

Detection rules

Source	Rule	Status	Updated
splunk	Wmic Group Discovery	production	2026-10-02
splunk	Windows Group Discovery Via Net	production	2026-10-02
splunk	Powershell Get LocalGroup Discovery with Script Block Logging	production	2026-10-02
splunk	PowerShell Get LocalGroup Discovery	production	2026-10-02
splunk	Get WMIObject Group Discovery with Script Block Logging	production	2026-10-02
splunk	Get WMIObject Group Discovery	production	2026-10-02
splunk	Detect SharpHound Usage	production	2026-10-02
splunk	Detect SharpHound File Modifications	production	2026-10-02
splunk	Detect SharpHound Command-Line Arguments	production	2026-10-02
elastic	PowerShell Suspicious Discovery Related Windows API Functions	production	2026-09-18
elastic	Unusual User Privilege Enumeration via id	production	2026-09-18
elastic	Enumeration of Privileged Local Groups Membership	production	2026-09-18
elastic	Sudo Command Enumeration Detected	production	2026-09-18
elastic	Enumeration of Administrator Accounts	production	2026-09-18
elastic	Enumeration of Users or Groups via Built-in Commands	production	2026-09-18
sigma	Permission Check Via Accesschk.EXE	test	2026-06-29
splunk	Network Traffic to Active Directory Web Services Protocol	production	2026-05-13
splunk	Detect AzureHound Command-Line Arguments	production	2026-05-13
splunk	Detect AzureHound File Modifications	production	2026-05-13
splunk	Windows Admin Permission Discovery	production	2026-05-13
splunk	Windows SOAPHound Binary Execution	production	2026-05-13
sigma	BloodHound Collection Files	test	2026-02-19
sigma	Malicious PowerShell Commandlets - PoshModule	test	2025-12-10
sigma	Malicious PowerShell Commandlets - ProcessCreation	test	2025-12-10
sigma	Malicious PowerShell Commandlets - ScriptBlock	test	2025-12-10
sigma	Suspicious Get Local Groups Information - PowerShell	test	2025-08-22
sigma	Suspicious Get Local Groups Information	test	2025-08-22
sigma	Local Groups Discovery - Linux	test	2025-06-04
sigma	Local Groups Reconnaissance Via Wmic.EXE	test	2023-02-14
sigma	HackTool - Bloodhound/Sharphound Execution	test	2023-02-04
sigma	AD Groups Or Users Enumeration Using PowerShell - PoshModule	test	2023-01-20
sigma	AD Groups Or Users Enumeration Using PowerShell - ScriptBlock	test	2022-12-25
sigma	Suspicious Get Information for SMB Share	test	2022-12-25
sigma	Suspicious Get Information for SMB Share - PowerShell Module	test	2022-12-02
sigma	Local Groups Discovery - MacOs	test	2022-11-27
sigma	Net.EXE Execution	test	2022-07-11