Linux Local Group Enumeration via Standard Utilities

Adversaries often perform local group enumeration to identify target accounts for privilege escalation or lateral movement. Threat actors use common Linux system utilities, such as 'getent', 'groups', and various file readers, to query '/etc/group' or '/etc/gshadow' files to gain visibility into system account permissions and administrative group membership.

Impact

The impact of group enumeration is primarily reconnaissance. Successful discovery allows an attacker to identify high-privilege users or security groups, facilitating subsequent phases of an attack such as credential harvesting or privilege escalation.

Recommendation

Deploy the provided Sigma detection rule to monitor process executions involving sensitive group files or enumeration tools. Because these utilities are heavily used for legitimate system administration, focus analysis on deviations from established administrative baselines or account behavior.