Permission Groups Discovery: Local Groups

Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.

Commands such as net localgroup of the Net utility, dscl . -list /Groups on macOS, and groups on Linux can list local groups.

ID: T1069.001
Sub-technique of:  T1069
Tactic: Discovery
Platforms: Linux, Windows, macOS
Permissions Required: User
Data Sources: API monitoring, Process command-line parameters, Process monitoring
Version: 1.0
Created: 12 March 2020
Last Modified: 26 March 2020

Procedure Examples

Name Description
admin@338

admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: net localgroup administrator >> %temp%\download[13]

Emissary

Emissary has the capability to execute the command net localgroup administrators.[8]

Epic

Epic gathers information on local group names.[10]

FlawedAmmyy

FlawedAmmyy enumerates the privilege level of the victim during the initial infection.[11]

Helminth

Helminth has checked the local administrators group.[5]

JPIN

JPIN can obtain the permissions of the victim user.[9]

Kazuar

Kazuar gathers information about local groups and members.[6]

Kwampirs

Kwampirs collects a list of users belonging to the local users and administrators groups with the commands net localgroup administrators and net localgroup users.[3]

Net

Commands such as net group and net localgroup can be used in Net to gather information about and manipulate groups.[1]

OilRig

OilRig has used net localgroup administrators to find local administrators on compromised systems.[14]

OSInfo

OSInfo has enumerated the local administrators group.[7]

PoshC2

PoshC2 contains modules, such as Get-LocAdm for enumerating permission groups.[2]

POWRUNER

POWRUNER may collect local group information by running net localgroup administrators or a series of other commands on a victim.[12]

Sys10

Sys10 collects the group name of the logged-in user and sends it to the C2.[4]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

References