MalCommands — dsquery

#					tactics	techniques	os

detail

Command Line

dsquery group -limit 0

Description

Utilize DSQuery to retrieve information about groups in Active Directory.

Risk

Low

Risk Reason

On it's own this command doesn't have immediate negative consequences but it's use should be audited if possible to detect potential threats.

Fidelity

Medium

Fidelity Reason

Depending on the organization, it's possible that this is an infrequently used command and it's use may be regularly audited.

Operating Systems

windows

Killchain Phases

Actions on Objectives

References

TOOL DATA

Tool Name: dsquery

Tool URL: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc732952(v=ws.11)

Tool Description: DSQuery provides a mechanism to query Active Directory and is built into Server 2008 and later if the AD DS server role is installed.

Common Tool Locations

C:\Windows\System32\dsquery.exe

Common Tool Arguments

computer - Finds computers in the directory matching specified search criteria.
group - Finds groups in the directory matching specified search criteria.
user - Finds users in the directory matching specified search criteria.
Many More - Follow Tool URL to discover usage capabilities with respect to filtering, searching, etc.

MITRE ATT&CK TECHNIQUES

Technique: T1069.002 - Domain Groups

URL: https://attack.mitre.org/techniques/T1069/002

Description: Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators. Commands such as net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility, dscacheutil -q group on macOS, and ldapsearch on Linux can list domain-level groups.

Tactics:

Discovery