RTT · red team

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Techniques Tools Commands APTs

Search techniques, tools, commands…⌘K

No scenario

No scenario · all techniques in scope

IdleStatus

0Scenarios

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Local Groups Discovery | RTT

Back to Techniques

Techniques›Host Enumeration›Local Groups Discovery

Host Enumeration

Local Groups Discovery

T1069.001 · MITRE ATT&CK

Enumerate local security groups and group memberships on an authorized host to understand assigned permissions, including which accounts hold local administrative rights. These read-only queries report membership; they do not change it.

ArtifactsRESTRICTED_ACCESS_BLUR_MARKER

Steps1

CategoryLocal Host Enumeration

Discuss in Advisor

Walkthrough

01

Step 1

RESTRICTED_ACCESS_BLUR_MARKER

RESTRICTED_ACCESS_BLUR_MARKER

Requirements: ALL(RESTRICTED_ACCESS_BLUR_MARKER)

Coverage Gap: No catalog tool command currently produces this step's declared outcomes.

RESTRICTED_ACCESS_BLUR_MARKER

Detection signal

Detection 01

RESTRICTED_ACCESS_BLUR_MARKER

Mitigations

Mitigation 01

RESTRICTED_ACCESS_BLUR_MARKER

OPSEC notes

RESTRICTED_ACCESS_BLUR_MARKER

References

https://attack.mitre.org/techniques/T1069/001/
https://attack.mitre.org/detectionstrategies/DET0114/
https://learn.microsoft.com/ga-ie/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc725622%28v%3Dws.11%29
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.localaccounts/get-localgroup?view=powershell-5.1
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.localaccounts/get-localgroupmember?view=powershell-5.1
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers
https://www.man7.org/linux/man-pages/man1/getent.1.html
https://www.man7.org/linux/man-pages/man1/id.1p.html
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models

Extended details

RESTRICTED_ACCESS_BLUR_MARKER