AN0507
Analytic 0507
Windows
Detection of adversary enumeration of domain or local group memberships via native tools such as net.exe, PowerShell, or WMI. This activity may precede lateral movement or privilege escalation.
WinEventLog:Security
EventCode=4688
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
[CommandLineRegex]
Regex filters for matching suspicious group enumeration commands (e.g., 'net group', 'Get-ADGroupMember').
[TimeWindow]
Time threshold for correlating group discovery with subsequent suspicious activity (e.g., lateral movement).
[UserContext]
Whether the user performing discovery is in a sensitive group or running under unusual context (e.g., non-admin querying Domain Admins).
AN0508
Analytic 0508
Linux
Detection of group enumeration using commands like 'id', 'groups', or 'getent group', often followed by privilege escalation or SSH lateral movement.
auditd:SYSCALL
execve
[CommandLine]
Variations of enumeration commands tailored to different Linux distros (e.g., 'getent group', 'cut -d' in /etc/group parsing).
[TTYSession]
TTY context or source terminal (remote shell vs local login) to reduce noise.
AN0509
Analytic 0509
macOS
Group membership checks via 'dscl', 'dscacheutil', or 'id', typically executed via terminal or automation scripts.
macos:unifiedlog
process:launch
[CommandLine]
Filters for suspicious execution of 'dscl . -read /Groups', etc.
[ParentProcess]
Flag group enumeration from automation tools (e.g., LaunchAgents or suspicious apps).