Permission Groups Discovery: Local Groups

Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.

Commands such as net localgroup of the Net utility, dscl . -list /Groups on macOS, and groups on Linux can list local groups.

ID: T1069.001
Sub-technique of:  T1069
Tactic: Discovery
Platforms: Linux, Windows, macOS
Permissions Required: User
Data Sources: Command: Command Execution, Process: Process Creation
Version: 1.0
Created: 12 March 2020
Last Modified: 26 March 2020

Procedure Examples

ID Name Description
G0018 admin@338

admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: net localgroup administrator >> %temp%\download[1]

S0521 BloodHound

BloodHound can collect information about local groups and members.[2]

S0572 Caterpillar WebShell

Caterpillar WebShell can obtain a list of local groups of users from a system.[3]

G0114 Chimera

Chimera has used net localgroup administrators to identify accounts with local administrative rights.[4]

S0082 Emissary

Emissary has the capability to execute the command net localgroup administrators.[5]

S0091 Epic

Epic gathers information on local group names.[6]

S0381 FlawedAmmyy

FlawedAmmyy enumerates the privilege level of the victim during the initial infection.[7]

S0170 Helminth

Helminth has checked the local administrators group.[8]

S0201 JPIN

JPIN can obtain the permissions of the victim user.[9]

S0265 Kazuar

Kazuar gathers information about local groups and members.[10]

S0236 Kwampirs

Kwampirs collects a list of users belonging to the local users and administrators groups with the commands net localgroup administrators and net localgroup users.[11]

S0039 Net

Commands such as net group and net localgroup can be used in Net to gather information about and manipulate groups.[12]

G0049 OilRig

OilRig has used net localgroup administrators to find local administrators on compromised systems.[13]

G0116 Operation Wocao

Operation Wocao has used the command net localgroup administrators to list all administrators part of a local group.[14]

S0165 OSInfo

OSInfo has enumerated the local administrators group.[15]

S0378 PoshC2

PoshC2 contains modules, such as Get-LocAdm for enumerating permission groups.[16]

S0184 POWRUNER

POWRUNER may collect local group information by running net localgroup administrators or a series of other commands on a victim.[17]

S0060 Sys10

Sys10 collects the group name of the logged-in user and sends it to the C2.[18]

G0010 Turla

Turla has used net localgroup and net localgroup Administrators to enumerate group information, including members of the local administrators group.[19]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

References