What is permission and group discovery?¶
Permission and group discovery is activity used to learn what access rights, roles or memberships exist within a system or account environment.
Avoid the dangerous assumption¶
The dangerous assumption is that being listed in an administrator or privileged group proves malicious use of that privilege.
It does not.
An offender may query:
- local administrator groups
- directory groups
- cloud roles
- application permissions
- delegated access
- service-account rights
- file and folder permissions
- ownership and access-control lists.
The aim may be to identify accounts or resources that provide broader control.
Investigators should preserve:
- the query or command
- the account context
- the target directory or system
- the time
- the output
- later privilege or access activity.
Legitimate administration, identity governance and security tooling routinely perform the same queries.
The sequence matters.
A permission query followed by role activation, account compromise or access to protected resources may support deliberate reconnaissance.
A routine audit may not.
Do not assume that a discovered permission was actually exercised.
Likewise, excessive permission may explain opportunity without proving responsibility for later activity.
Where cloud or application roles are involved, stable role and object identifiers may be more reliable than display names.
Permission discovery may also explain why an offender abandoned one account and moved towards another. Preserve the role information available at the time rather than relying only on the current permissions after containment.
Group membership may also be inherited or nested, so the effective permission may not be obvious from one direct membership record.
Operational takeaway¶
Use permission and group discovery to establish what access was being assessed, and prove later privilege use separately from the discovery of that access.