Dark Mode
Capec-576 Detail
Group Permission Footprinting
Standard Software Likelihood: Low Typical Severity: Low
Parents: 169
Threats: T60 T65 T80 T258 T288 T291 T302 T334 T392 T407
An adversary exploits functionality meant to identify information about user groups and their permissions on the target system to an authorized user. By knowing what users/permissions are registered on the target system, the adversary can inform further and more targeted malicious behavior. An example Windows command which can list local groups is "net localgroup".
Not present
| External ID | Source | Link | Description |
|---|---|---|---|
| CAPEC-576 | capec | https://capec.mitre.org/data/definitions/576.html | |
| CWE-200 | cwe | http://cwe.mitre.org/data/definitions/200.html | |
| T1069 | ATTACK | https://attack.mitre.org/wiki/Technique/T1069 | Permission Groups Discovery |
| T1615 | ATTACK | https://attack.mitre.org/wiki/Technique/T1615 | Group Policy Discovery |
Not present
- The adversary must have gained access to the target system via physical or logical means in order to carry out this attack.
Not present
Not present
| Authorization | Access Control | Confidentiality |
|---|---|---|
| Bypass Protection Mechanism | Bypass Protection Mechanism | Other |
| Hide Activities | Hide Activities | Bypass Protection Mechanism |
| Hide Activities |
Not present