value:  Helminth has checked for the domain admin group and Exchange Trusted Subsystem groups using the commands net group Exchange Trusted Subsystem /domain and net group domain admins /domain. ;; Inception has used specific malware modules to gather domain membership. ;; Ke3chang performs discovery of permission groups net group /domain. ;; Kwampirs collects a list of domain groups with the command net localgroup /domain. ;; Commands such as net group /domain can be used in Net to gather information about and manipulate groups. ;; OilRig has used net group /domain net group “domain admins” /domain and net group “Exchange Trusted Subsystem” /domain to find domain group permission settings. ;; OSInfo specifically looks for Domain Admins and power users within the domain. ;; POWRUNER may collect domain group information by running net group /domain or a series of other commands on a victim. ;; REvil can identify the domain membership of a compromised host. ;; SoreFang can enumerate domain groups by executing net.exe group /domain. ;; Turla has used net group Domain Admins" /domain to identify domain administrators. ;; WellMess can identify domain group membership for the current user."
name: Permission Groups Discovery: Domain Groups