Permission Groups Discovery: Local Groups

Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.

Commands such as net localgroup of the Net utility, dscl . -list /Groups on macOS, and groups on Linux can list local groups.

ID: T1069.001
Sub-technique of:  T1069
Tactic: Discovery
Platforms: Linux, Windows, macOS
Permissions Required: User
Data Sources: API monitoring, Process command-line parameters, Process monitoring
Version: 1.0
Created: 12 March 2020
Last Modified: 26 March 2020

Procedure Examples

Name Description

admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: net localgroup administrator >> %temp%\download[1]


BloodHound can collect information about local groups and members.[2]


Emissary has the capability to execute the command net localgroup administrators.[3]


Epic gathers information on local group names.[4]


FlawedAmmyy enumerates the privilege level of the victim during the initial infection.[5]


Helminth has checked the local administrators group.[6]


JPIN can obtain the permissions of the victim user.[7]


Kazuar gathers information about local groups and members.[8]


Kwampirs collects a list of users belonging to the local users and administrators groups with the commands net localgroup administrators and net localgroup users.[9]


Commands such as net group and net localgroup can be used in Net to gather information about and manipulate groups.[10]


OilRig has used net localgroup administrators to find local administrators on compromised systems.[11]


OSInfo has enumerated the local administrators group.[12]


PoshC2 contains modules, such as Get-LocAdm for enumerating permission groups.[13]


POWRUNER may collect local group information by running net localgroup administrators or a series of other commands on a victim.[14]


Sys10 collects the group name of the logged-in user and sends it to the C2.[15]


Turla has used net localgroup and net localgroup Administrators to enumerate group information, including members of the local administrators group.[16]


This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.


System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.