Skip to content

Local Groups

Subtechnique · ATTACK:enterprise:T1069.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1069.001",
  "title": "Local Groups",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1069/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--a01bf75f-00b2-4568-a58f-565ff9bf202b",
  "external_id": "T1069.001",
  "domain": "enterprise",
  "created": "2020-03-12T19:29:21.013Z",
  "modified": "2026-05-12T15:12:00.706Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [

  ]
}

Explicit source assertions (33)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--059cc1e2-9570-4760-8137-d3d71b66bb78

ESET ComRAT May 2020

ATTACK:enterprise:S0201 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21fdaa87-7b0e-4ad9-a612-c4d2ec8789d7

Microsoft PLATINUM April 2016

ATTACK:enterprise:S0060 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2cfa6113-1995-494a-b767-61d3f371e0ea

Baumgartner Naikon 2015

ATTACK:enterprise:S0521 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42a87d45-8dd1-4767-a6a2-d7bd19d3b0ef

CrowdStrike BloodHound April 2018

ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--46b32cc8-892c-48da-92ab-4ec2168e3edb

GitHub SILENTTRINITY Modules July 2019

ATTACK:enterprise:S1179 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--46d2d469-def8-477f-b738-72026128af21

Microsoft BlackByte 2023

ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--481fedde-ac7d-4d1b-a70a-b90ccd7acc52

TrendMicro Tonto Team October 2020

ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5650777d-f905-4c09-8fd0-0e205178a830

FireEye APT34 Dec 2017

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5968f7a6-a300-4a1b-9a4e-655e9300392b

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c8e77a8-03f4-4581-a893-a07016bc155f

Kaspersky Lyceum October 2021

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--664d1aaf-eb98-4683-bc57-1a19934d934a

FoxIT Wocao December 2019

ATTACK:enterprise:T1069.001 → subtechnique-of → ATTACK:enterprise:T1069

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b46c35d-aa25-430c-89a2-d8f512478122

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e311ecd-a80d-411b-aaef-ddc69749a8a8

Trend Micro Black Basta October 2022 · Kaspersky QakBot September 2021

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72e0dd03-d994-4a38-97a8-dab5ae456cbc

Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75f7d0e0-b1e9-4289-8895-d8a262930523

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75fcbeab-4f32-4e6d-a02a-9d5509fd4c4f

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--77bd9ea1-9401-4128-a78a-bd28d43a6c99

Unit 42 Kazuar May 2017

ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d047513-5fbf-4d9e-8a5d-54317123e34c

FireEye admin@338

ATTACK:enterprise:S0082 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8ca14a24-b8b3-4669-ae56-e7102b543dc6

Emissary Trojan Feb 2016

ATTACK:enterprise:S0696 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f5db833-979f-43c1-a28c-8a9ef3bb7980

NTT Security Flagpro new December 2021

ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--938fe8be-be14-41a6-9db5-238866bb77ea

Cybereason OperationCuckooBees May 2022

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95747003-2c4a-4e4a-ad9d-fde75f04f406

NCC Group Chimera January 2021

ATTACK:enterprise:S0572 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c089e25-2028-4afb-9f05-b28d5055f444

ClearSky Lebanese Cedar Jan 2021

ATTACK:enterprise:S1141 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b157603d-42be-40c2-b88d-16a0ba065f76

ESET Turla Lunar toolset May 2024

ATTACK:enterprise:S0170 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b3981ca6-7ef0-4625-99a8-9cbec731bac9

Unit 42 Playbook Dec 2017

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc5b2681-d0e9-4ef5-9a90-56358ea34d96

Kaspersky Turla Aug 2014

ATTACK:enterprise:S0165 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc85f8f4-5d65-484c-af82-6adbe42083d9

Symantec Buckeye

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c08d8f49-5cca-4463-81db-bb80cc9a7af6

Joint Cybersecurity Advisory Volt Typhoon June 2023

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d39e3775-9221-4020-b826-edc111e36c7c

Palo Alto OilRig May 2016 · Symantec Crambus OCT 2023

ATTACK:enterprise:S1198 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d8dc23f0-67a2-4cf8-a22c-ee63b5631715

Symantec Troll Stealer 2024

ATTACK:enterprise:C0061 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d95c42de-dea9-4073-a4f3-c4419cf91f4e

sentinelone operationDigitalEye Dec 2024

ATTACK:enterprise:S0381 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f54cba45-e641-49e0-b015-b5f6f8a05002

Korean FSI TA505 2020 · Proofpoint TA505 Mar 2018

ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fb243cd7-7dec-4836-a341-c9e30c0099ee

Symantec Orangeworm April 2018

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.