Permission Groups Discovery
Permission-group discovery examines group membership and privilege relationships.
What it means
Permission-group discovery examines group membership and privilege relationships. The information can reveal powerful identities or useful authorization paths.
An investigation example
An unfamiliar account enumerates administrative group membership before attempting access to selected servers.
Evidence to examine
Review directory queries, source identity, query scope, and later use of discovered group or account information.
A common analytical pitfall
Group inventory is also ordinary identity administration; the responsible actor and purpose are important.
Response considerations
Investigate the access chain and follow-on targeting, then assess whether unnecessary privileges enlarged the available attack paths.
Membership suggests authority but does not prove every permission
Permission groups organize identities and access relationships. Discovering membership can reveal administrators, application roles, or potentially useful account relationships. The resulting list may guide an intruder's choices, but actual access also depends on scope, policy, resource configuration, and other controls. A group name is not a universal statement of effective authority.
Groups may be local, directory-based, or cloud-managed, with nested relationships and exceptions. Record which scope was queried and whether the result represents direct or effective membership. Stale entries and synchronization delays can complicate interpretation. Routine access reviews and support processes legitimately gather similar information.
A fictional administrator-targeting lead
An academy's logs show an unfamiliar identity querying privileged groups before attempts against selected accounts. Analysts preserve the query context and later authentication outcomes, then compare the behavior with approved access-review work. The discovery event may explain targeting, but it does not establish that any privileged account was successfully used.
A current group listing may not show membership at the incident time. Seek historical change records where relevant and state the gap if they are unavailable. Also distinguish the authority of the querying identity from the authority of the identities it discovered. Visibility into a group does not necessarily mean the requester belongs to it.
Build a small membership model
Draw fictional users, two nested groups, and a protected application. Mark direct membership, inherited relationships, and the application's actual authorization rule. Explain which facts a group query reveals and which require a resource-permission review. Use a paper model or dedicated lab rather than enumerating a real directory without permission.
This precision improves response planning. A suspicious query may justify investigating the session and reviewing unnecessary visibility, while a permission change or successful privileged action requires separate evidence and containment decisions. Avoid collapsing knowledge of a privileged group into a claim of privilege escalation.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1069: Permission Groups Discovery