Permission Groups Discovery: Domain Groups

AdFind can enumerate domain groups.^[1][2][3]

BloodHound can collect information about domain groups and members.^[4]

CrackMapExec can gather the user accounts within domain groups.^[5]

Dragonfly 2.0 used batch scripts to enumerate administrators and users in the domain.^[6]

dsquery can be used to gather information on permission groups within a domain.^[7]

FIN6 has used tools like Adfind to query users, groups, organizational units, and trusts.^[2]

GRIFFON has used a reconnaissance module that can be used to retrieve Windows domain membership information.^[8]

Helminth has checked for the domain admin group and Exchange Trusted Subsystem groups using the commands net group Exchange Trusted Subsystem /domain and net group domain admins /domain.^[9]

Inception has used specific malware modules to gather domain membership.^[10]

Ke3chang performs discovery of permission groups net group /domain.^[11]

Kwampirs collects a list of domain groups with the command net localgroup /domain.^[12]

Commands such as net group /domain can be used in Net to gather information about and manipulate groups.^[13]

OilRig has used net group /domain, net group "domain admins" /domain, and net group "Exchange Trusted Subsystem" /domain to find domain group permission settings.^[14]

OSInfo specifically looks for Domain Admins and power users within the domain.^[15]

POWRUNER may collect domain group information by running net group /domain or a series of other commands on a victim.^[16]

REvil can identify the domain membership of a compromised host.^[17][18][19]

SoreFang can enumerate domain groups by executing net.exe group /domain.^[20]

Turla has used net group "Domain Admins" /domain to identify domain administrators.^[21]

WellMess can identify domain group membership for the current user.^[22]

Wizard Spider has used AdFind.exe to collect information about Active Directory groups and accounts.^{[3][23][24][1]}