Command Line
dsquery group -name "Domain Admins"
Description
Utilize DSQuery to retrieve information about a specific group in Active Directory.
Risk
Low
Risk Reason
On it's own this command doesn't have immediate negative consequences but it's use should be audited if possible to detect potential threats.
Fidelity
Medium
Fidelity Reason
Depending on the organization, it's possible that this is an infrequently used command and it's use may be regularly audited.
Operating Systems
Killchain Phases
References
MITRE ATT&CK TECHNIQUES
URL: https://attack.mitre.org/techniques/T1069/002
Description: Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.
Commands such as net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility, dscacheutil -q group on macOS, and ldapsearch on Linux can list domain-level groups.
Tactics: