AN0317
Analytic 0317
Windows
Detects attempts to enumerate local groups via Net.exe, PowerShell, or native API calls that precede lateral movement or privilege abuse.
WinEventLog:Security
EventCode=4688
[TimeWindow]
Time window between group enumeration and lateral movement or privilege escalation activity.
[UserContext]
Whether the process was executed by a privileged or low-privilege account.
AN0318
Analytic 0318
Linux
Detects enumeration of local groups using common binaries (groups, getent, cat /etc/group) or scripting with suspicious lineage.
auditd:SYSCALL
execve
[ProcessName]
Detection tuning for binaries like `groups`, `getent`, `awk`, or `cut` that may be used in pipelines.
[ParentProcess]
Used to determine whether enumeration was triggered by a script or terminal.
AN0319
Analytic 0319
macOS
Detects use of dscl or id/group commands to enumerate local system groups, often by post-exploitation tools or persistence checks.
macos:unifiedlog
process:exec
[CommandLineContains]
Match on specific dscl paths like '/Groups' or known enumeration options.
[InteractiveSession]
Used to scope out enumeration from user terminals versus background utilities.