Permission Groups Discovery: Local Groups

admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: net localgroup administrator >> %temp%\download^[1]

BloodHound can collect information about local groups and members.^[2]

During C0015, the threat actors used the command net localgroup "adminstrator" to identify accounts with local administrator rights.^[3]

Caterpillar WebShell can obtain a list of local groups of users from a system.^[4]

Chimera has used net localgroup administrators to identify accounts with local administrative rights.^[5]

Cobalt Strike can use net localgroup to list local groups on a system.^[6]

Emissary has the capability to execute the command net localgroup administrators.^[7]

Epic gathers information on local group names.^[8]

Exbyte checks whether the process is running with privileged local access during execution.^[9]

Flagpro has been used to execute the net localgroup administrators command on a targeted system.^[10]

FlawedAmmyy enumerates the privilege level of the victim during the initial infection.^[11][12]

Gomir checks the effective group ID of its process when initially executed to determine if it is in group 0, denoting superuser privileges in Linux environments.^[13]

Helminth has checked the local administrators group.^[14]

HEXANE has run net localgroup to enumerate local groups.^[15]

JPIN can obtain the permissions of the victim user.^[16]

Kazuar gathers information about local groups and members.^[17]

Kwampirs collects a list of users belonging to the local users and administrators groups with the commands net localgroup administrators and net localgroup users.^[18]

LunarWeb can discover local group memberships.^[19]

Commands such as net group and net localgroup can be used in Net to gather information about and manipulate groups.^[20]

OilRig has used net localgroup administrators to find local administrators on compromised systems.^[21][22]

During Operation CuckooBees, the threat actors used the net group command as part of their advanced reconnaissance.^[23]

During Operation Wocao, threat actors used the command net localgroup administrators to list all administrators part of a local group.^[24]

OSInfo has enumerated the local administrators group.^[25]

PoshC2 contains modules, such as Get-LocAdm for enumerating permission groups.^[26]

POWRUNER may collect local group information by running net localgroup administrators or a series of other commands on a victim.^[27]

QakBot can use net localgroup to enable discovery of local groups.^[28][29]

SILENTTRINITY can obtain a list of local groups and members.^[30]

Sys10 collects the group name of the logged-in user and sends it to the C2.^[31]

Tonto Team has used the ShowLocalGroupDetails command to identify administrator, user, and guest accounts on a compromised host.^[32]

Turla has used net localgroup and net localgroup Administrators to enumerate group information, including members of the local administrators group.^[33]

Volt Typhoon has run net localgroup administrators in compromised environments to enumerate accounts.^[34]