| 名称 |
Group Permission Footprinting |
|
|
| 摘要 |
An adversary exploits functionality meant to identify information about user groups and their permissions on the target system to an authorized user. By knowing what users/permissions are registered on the target system, the adversary can inform further and more targeted malicious behavior. An example Windows command which can list local groups is "net localgroup". |
| 前置条件 |
The adversary must have gained access to the target system via physical or logical means in order to carry out this attack. |
| 解决方案 | Identify programs (such as "net") that may be used to enumerate local group permissions and block them by using a software restriction Policy or tools that restrict program execution by using a process allowlist. |
| 关联弱点 |
|
CWE 编号
|
描述
|
| CWE-200 |
Exposure of Sensitive Information to an Unauthorized Actor |
|
| 关联 CAPEC |
|
CAPEC 编号
|
描述
|
| CAPEC-169 |
An adversary engages in probing and exploration activities to identify constituents and properties of the target. |
|
| 分类体系：ATTACK |
|
条目编号
|
条目名称
|
| 1069 |
Permission Groups Discovery |
| 1615 |
Group Policy Discovery |
|