Atomic Red T1069.002

Invoke-AtomicTest T1069.002

Executes the atomic test for domain group discovery (T1069.002) with Atomic Red Team, validating the detection of group enumeration.

Run it in the purple team lab when you want to validate detection of domain group enumeration: the T1069.002 atomic enumerates groups (net group /domain, AD queries) and the team checks what was detected — AD queries (4662), SIEM rules, EDR. It's validation of enumeration detection: the attacker phase that maps the domain. In purple teaming, the atomic validates enumeration rules and the result feeds the matrix.

Do not run in production: enumeration generates real queries — the lab (with test domain) is the place. And note: detection of group enumeration is difficult (net group is legitimate) — the rule relies on volume and context; the atomic validates that telemetry logs the query, real detection is in correlation. The atomic needs the test domain (or lab DC): without the domain, enumeration fails. The 'detected' result depends on the deployed enumeration rule; the isolated atomic may trigger nothing — valid exercise outcome.