Account Discovery: Local Account

admin@338 actors used the following commands following exploitation of a machine with LOWBALL malware to enumerate user accounts: net user >> %temp%\download net user /domain >> %temp%\download^[5]

Agent Tesla can collect account information from the victim’s machine.^[6]

APT1 used the commands net localgroup,net user, and net group to find accounts on the system.^[1]

APT3 has used a tool that can obtain info about local and global group users, power users, and administrators.^[7]

APT32 enumerated administrative users using the commands net localgroup administrators.^[8]

APT41 used built-in net commands to enumerate local administrator groups.^[9]

APT42 has used the PowerShell-based POWERPOST script to collect local account names from the victim machine.^[10]

Bankshot gathers domain and account names/information through process monitoring.^[11]

Bazar can identify administrator accounts on an infected host.^[12]

BitPaymer can enumerate the sessions for each user logged onto the infected host.^[13]

BloodHound can identify users with local administrator rights.^[14]

Chimera has used net user for account discovery.^[15]

Comnie uses the net user command.^[16]

The discovery modules used with Duqu can collect information on accounts and permissions.^[17]

DUSTTRAP can enumerate local user accounts.^[18]

Elise executes net user after initial communication is made to the remote server.^[19]

Empire can acquire local and domain user account information.^[20]

Epic gathers a list of all user accounts, privilege classes, and time of last logon.^[21]

Fox Kitten has accessed ntuser.dat and UserClass.dat on compromised hosts.^[22]

GeminiDuke collects information on local user accounts from the victim.^[23]

HyperStack can enumerate all account names on a remote share.^[24]

InvisibleFerret has queried the victim device using Python scripts to obtain the User and Hostname.^[25][26]

InvisiMole has a command to list account information on the victim’s machine.^[27]

Kazuar gathers information on local groups and members on the victim’s machine.^[28]

Ke3chang performs account discovery using commands such as net localgroup administrators and net group "REDACTED" /domain on specific permissions groups.^[29]

Kwampirs collects a list of accounts with the command net users.^[30]

Lotus Blossom has used commands such as net to profile local system users.^[31]

Medusa Group has leveraged net user for account discovery.^[32]

MgBot includes modules for identifying local administrator accounts on victim systems.^[33]

Milan has run C:\Windows\system32\cmd.exe /c cmd /c dir c:\users\ /s 2>&1 to discover local accounts.^[34]

Mis-Type may create a file containing the results of the command cmd.exe /c net user {Username}.^[35]

Moses Staff has collected the administrator username from a compromised host.^[36]

MURKYTOP has the capability to retrieve information about users on remote hosts.^[37]

Commands under net user can be used in Net to gather information about and manipulate user accounts.^[38]

OilRig has run net user, net user /domain, net group "domain admins" /domain, and net group "Exchange Trusted Subsystem" /domain to get account listings on a victim.^[39]

During Operation CuckooBees, the threat actors used the net user command to gather account information.^[40]

OSInfo enumerates local and domain users^[7]

P.A.S. Webshell can display the /etc/passwd file on a compromised host.^[41]

Pikabot will retrieve the name of the user associated with the thread under which the malware is executing.^[42]

Pony has used the NetUserEnum function to enumerate local accounts.^[43]

Poseidon Group searches for administrator accounts on both the local victim machine and the network.^[44]

PoshC2 can enumerate local and domain user account information.^[45]

PowerSploit's Get-ProcessTokenGroup Privesc-PowerUp module can enumerate all SIDs associated with its current token.^[46][47]

POWERSTATS can retrieve usernames from compromised hosts.^[48]

PUNCHBUGGY can gather user names.^[49]

Pupy uses PowerView and Pywerview to perform discovery commands such as net user, net group, net local group, etc.^[50]

Qilin can list all local users found on a targeted system.^[51]

Raccoon Stealer checks the privileges of running processes to determine if the running user is equivalent to NT Authority\System.^[52]

RATANKBA uses the net user command.^[53]

RedCurl has collected information about local accounts.^[54][55]

RedLine Stealer has collected account information from the victim’s machine.^[56][57]

Remsec can obtain a list of users.^[58]

S-Type has run the command net user on a victim.^[35]

SHOTPUT has a command to retrieve information about connected users.^[59]

SMOKEDHAM has used net.exe user and net.exe users to enumerate local accounts on a compromised host.^[60]

SoreFang can collect usernames from the local system via net.exe user.^[61]

Stuxnet enumerates user accounts of the local host.^[62]

Threat Group-3390 has used net user to conduct internal discovery of systems.^[63]

TrickBot collects the users of the system.^[64][65]

Turla has used net user to enumerate local accounts on the system.^[66][67]

USBferry can use net user to gather information about local accounts.^[68]

Valak has the ability to enumerate local admin accounts.^[69]

Volt Typhoon has executed net user and quser to enumerate local account information.^[70]

Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names. The Registry key is located at HKLM\ SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators. It can be disabled through GPO: Computer Configuration > [Policies] > Administrative Templates > Windows Components > Credential User Interface: Enumerate administrator accounts on elevation.^[71]