T1087.001 Local Account — ATT&CK Technique
Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior. Commands such as net user and net localgroup of the Net utility and id and groups on macOS and Linux can list local users and groups. On Linux, local users can also be enumerated through the use of the /etc/passwd file. On macOS, the dscl . list /Users command can be used to enumerate local accounts. On ESXi servers, the `esxcli system account list` command can list local user accounts.
Detection coverage (27)
- Net.EXE Execution low
- Local System Accounts Discovery - Linux low
- Local System Accounts Discovery - MacOs low
- Cisco Collect Data low
- BloodHound Collection Files high
- Malicious PowerShell Commandlets - PoshModule high
- Malicious PowerShell Commandlets - ScriptBlock high
- HackTool - Bloodhound/Sharphound Execution high
- Suspicious Group And Account Reconnaissance Activity Using Net.EXE medium
- Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet medium
- Malicious PowerShell Commandlets - ProcessCreation high
- Local Accounts Discovery low
- Suspicious Use of PsLogList medium
- Detect AzureHound Command-Line Arguments
- Detect AzureHound File Modifications
- Detect SharpHound Command-Line Arguments
- Detect SharpHound File Modifications
- Detect SharpHound Usage
- GetLocalUser with PowerShell Script Block
- GetLocalUser with PowerShell
- GetWmiObject User Account with PowerShell Script Block
- GetWmiObject User Account with PowerShell
- Local Account Discovery With Wmic
- Network Traffic to Active Directory Web Services Protocol
- Windows Account Discovery for None Disable User Account
- Windows SOAPHound Binary Execution
- Windows User Discovery Via Net
Malware using this technique
- TrickBot
- Pikabot
- MURKYTOP
- Stuxnet
- GeminiDuke
- InvisibleFerret
- Bankshot
- Pony
- HyperStack
- DUSTTRAP
- SystemBC
- InvisiMole
- P.A.S. Webshell
- Kazuar
- Raccoon Stealer
- SHOTPUT
- PUNCHBUGGY
- RATANKBA
- Remsec
- Epic
- Elise
- USBferry
- SMOKEDHAM
- Mis-Type
- RedLine Stealer
- Bazar
- MgBot
- Valak
- Milan
- Duqu
- Pupy
- Kwampirs
- Qilin
- SoreFang
- Agent Tesla
- POWERSTATS
- Comnie
- OSInfo
- BitPaymer
- Net
- BloodHound
- PowerSploit
- Empire
- PoshC2
- S-Type