diff --git a/LOOBins/dscacheutil.yml b/LOOBins/dscacheutil.yml index 162449e..01792c2 100644 --- a/LOOBins/dscacheutil.yml +++ b/LOOBins/dscacheutil.yml @@ -7,7 +7,7 @@ full_description: |- created: 2023-08-23 example_use_cases: - name: Lookup a user - description: List the user information + description: List the user information for code: dscacheutil -q user -a name tactics: - Discovery @@ -15,13 +15,29 @@ example_use_cases: - bash - zsh - name: Lookup all users - description: List the all users information + description: List all the users information code: dscacheutil -q user tactics: - Discovery tags: - bash - zsh + - name: Lookup a group + description: List the group information for + code: dscacheutil -q group -a name + tactics: + - Discovery + tags: + - bash + - zsh + - name: Lookup all groups + description: List all the groups information + code: dscacheutil -q group + tactics: + - Discovery + tags: + - bash + - zsh paths: - /usr/bin/dscacheutil detections: @@ -32,3 +48,7 @@ resources: url: https://macosbin.com/bin/dscacheutil - name: "dscacheutil man page" url: https://ss64.com/osx/dscacheutil.html + - name: "MITRE ATT&CK: T1069.002 Permission Groups Discovery: Domain Groups" + url: https://attack.mitre.org/techniques/T1069/002/ + - name: "MITRE ATT&CK: T1087.002 Account Discovery: Domain Account" + url: https://attack.mitre.org/techniques/T1087/002/