- one subtest per threat id T-12.1-18 to T-12.1-25, 27 to 31, 34, 38 and 39 - T-12.1-28 revisits T-12-18: the groups field is the one writer of users_groups - T-12.1-38 and T-12.1-39 cover the takeover guard for privileged-group members
