CAPEC-576: Group Permission Footprinting
Description
An adversary exploits functionality meant to identify information about user groups and their permissions on the target system to an authorized user. By knowing what users/permissions are registered on the target system, the adversary can inform further and more targeted malicious behavior. An example Windows command which can list local groups is net localgroup.
- Likelihood of attack
- Low
- Typical severity
- Low
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Collect and Analyze Information
Prerequisites
- The adversary must have gained access to the target system via physical or logical means in order to carry out this attack.
Consequences
- Confidentiality
Other
- ConfidentialityAccess ControlAuthorization
Bypass Protection Mechanism; Hide Activities
Mitigations
- Identify programs (such as net) that may be used to enumerate local group permissions and block them by using a software restriction Policy or tools that restrict program execution by using a process allowlist.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 2 ATT&CK techniques above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.