huntrule

Linux Local Groups Discovery via /groups or /etc/group File Enumeration

Detects Linux commands and utilities used to enumerate local groups and read /etc/group.

FreeReviewedSigma · Low · v2
Product
linux
Category
process_creation
Author
Ömer Günal, Alejandro Ortuno, oscd.community (SigmaHQ), DRL 1.1
Published
2020-10-11
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies attempts to enumerate local system groups by executing commands that reference /etc/group or by running a process whose image path ends with /groups. Adversaries may use this information to discover permission assignments and guide subsequent privilege and access attempts. The detection relies on process creation telemetry, matching executable image paths ending in specific utility names and command-line strings containing /etc/group.

Reporting behind it

Related detections9 linkedT1069.001 — drag to rearrange
Suspicious Group Discovery - Command (via process_creation)
Suspicious Group Discovery - PowerShell (via powershell)
Windows PowerShell module commandlet names matching known exploitation and post-exploitation tooling
Windows Process Creation: Suspicious PowerShell Commandlets Used by Known Exploitation Tools
Windows file creation for SharpHound/BloodHound collection output filenames
PowerShell Module: Get-SmbShare Used for SMB Share Discovery
PowerShell module enumeration of AD principals via get-ADPrincipalGroupMembership
PowerShell ScriptBlock Enumeration of AD Group Membership and User Attributes (Windows)
Windows PowerShell: Query SMB Shares via Get-SmbShare
Linux Local Groups Discovery via /groups or /etc/group File Enumeration
Pivot detection · T1069.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.