+Group Metadata

Group Metadata

Group metadata includes attributes like name, permissions, purpose, and associated user accounts or roles, which adversaries may exploit for privilege escalation. Examples:

  • Active Directory: Get-ADGroup -Identity "Domain Admins" -Properties Members, Description
  • Azure AD: Get-AzureADGroup -ObjectId <GroupId>
  • Google Workspace: GET https://admin.googleapis.com/admin/directory/v1/groups/<groupKey>
  • AWS IAM: aws iam list-group-policies --group-name <group_name>
  • Office 365: GET https://graph.microsoft.com/v1.0/groups/<id>

Data Collection Measures:

  • Cloud Logging:
  • AWS CloudTrail for IAM group-related activities.
  • Azure AD Sign-In/Audit logs for metadata changes.
  • Google Admin Activity logs for API calls.
  • Directory Logging: Log metadata access (e.g., Windows Event ID 4662).
  • API Monitoring: Log API calls to modify group metadata (e.g., Microsoft Graph API).
  • SIEM Integration: Centralize group metadata logs for analysis.

1. Overzicht

1.1 Referenties

1.2 Geïdentificeerde eisen

1.3 Gerelateerde regelingen

2. Geïdentificeerde eisen

Eisen

3. Gerelateerde regelingen

Regelingen

Gekoppelde issues

Koppelingen
is related to Data Components
  • MITREATTACK -

    EN: MITRE ATT&CK®, https://attack.mitre.org/. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. License: The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. See the Terms of Use for the disclaimers. ATT&CK® is a registered trademark of The MITRE Corporation. Converted into the GRCA format.

    DE: MITRE ATT&CK®, https://attack.mitre.org/. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE erlaubt die Nutzung für Forschung, Entwicklung und kommerzielle Zwecke, wenn jede Kopie den Urheberrechtsvermerk und die Lizenz enthält; maßgeblich ist der englische Wortlaut der Lizenz oben und die Terms of Use mit den Haftungsausschlüssen. ATT&CK® ist eine eingetragene Marke der MITRE Corporation. In das GRCA-Format umgewandelt.