Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions.

Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.(Citation: CrowdStrike BloodHound April 2018)
Permission Groups Discovery
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1069  external_id: T1069     source_name: K8s Authorization Overview  description: Kubernetes. (n.d.). Authorization Overview. Retrieved June 24, 2021.  url: https://kubernetes.io/docs/reference/access-authn-authz/authorization/     source_name: CrowdStrike BloodHound April 2018  description: Red Team Labs. (2018, April 24). Hidden Administrative Accounts: BloodHound to the Rescue. Retrieved October 28, 2020.  url: https://www.crowdstrike.com/blog/hidden-administrative-accounts-bloodhound-to-the-rescue/     