MalCommands

#					tactics	techniques	os

detail

Command Line

net group "Domain Admins" /domain

Description

View details about a specific Active Directory Group to identify critical users.

Risk

Low

Risk Reason

NET is commonly used to view details about a local or remote user, especially when troubleshooting permission or access issues.

Fidelity

High

Fidelity Reason

Querying the membership of critical groups is an extremely common cyber-threat operation and not very likely for normal users to perform frequently - this should be audited.

Operating Systems

windows

Killchain Phases

Actions on Objectives

References

TOOL DATA

Tool Name: net

Tool URL: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc754340(v=ws.11)#n

Tool Description: Net is an extremely robust utility developed by Microsoft and is commonly used by both IT operators and cyber-threats. It allows for querying of many pieces of environment information as well as configuring, creating or otherwise modifying items such as shares, services, users, etc.

Common Tool Locations

C:\Windows\System32\net.exe
C:\Windows\System32\net1.exe
C:\Windows\SysWOW64\net.exe
C:\Windows\SysWOW64\net1.exe

Common Tool Arguments

localgroup - Discover the members of a specific local group
computer - Add or Delete computers to or from Active Directory.
use - Connect or Disconnect a computer to or from a shared resource.
view - Display a list of domains, computers or resources being shared by the current or specified computer.

MITRE ATT&CK TECHNIQUES

Technique: T1069.002 - Domain Groups

URL: https://attack.mitre.org/techniques/T1069/002

Description: Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators. Commands such as net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility, dscacheutil -q group on macOS, and ldapsearch on Linux can list domain-level groups.

Tactics:

Discovery