Threat intelligence / Technique

Permission Groups Discovery

Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions. Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.(Citation: CrowdStrike BloodHound April 2018)

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions. Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.(Citation: CrowdStrike BloodHound April 2018)

17 recorded

Relationships

mapped-to

from Group Permission Footprinting

Technique

subtechnique-of

from Cloud Groups

Technique

subtechnique-of

from Domain Groups

Technique

subtechnique-of

from Local Groups

Technique

uses

from APT3

Group

uses

from APT41

Group

uses

Malware

uses

from FIN13

Group

uses

Malware

uses

Malware

uses

from Scattered Spider

Group

uses

from ShimRatReporter

Tool

uses

Malware

uses

from SolarWinds Compromise

Campaign

uses

from TA505

Group

uses

Malware

uses

from Volt Typhoon

Group

3 external

References

mitre-attack

T1069

K8s Authorization Overview

https://kubernetes.io/docs/reference/access-authn-authz/authorization/

CrowdStrike BloodHound April 2018

https://www.crowdstrike.com/blog/hidden-administrative-accounts-bloodhound-to-the-rescue/