Account Discovery: Local Account

Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.

Commands such as net user and net localgroup of the Net utility and id and groupson macOS and Linux can list local users and groups. On Linux, local users can also be enumerated through the use of the /etc/passwd file.

ID: T1087.001
Sub-technique of:  T1087
Tactic: Discovery
Platforms: Linux, Windows, macOS
Permissions Required: User
Data Sources: API monitoring, Process command-line parameters, Process monitoring
Version: 1.0
Created: 21 February 2020
Last Modified: 20 March 2020

Procedure Examples

Name Description
admin@338

admin@338 actors used the following commands following exploitation of a machine with LOWBALL malware to enumerate user accounts: net user >> %temp%\download net user /domain >> %temp%\download[33]

Agent Tesla

Agent Tesla can collect account information from the victim’s machine.[19]

APT1

APT1 used the commands net localgroup,net user, and net group to find accounts on the system.[34]

APT3

APT3 has used a tool that can obtain info about local and global group users, power users, and administrators.[28]

APT32

APT32 enumerated administrative users using the commands net localgroup administrators.[35]

Bankshot

Bankshot gathers domain and account names/information through process monitoring.[27]

Carbon

Carbon runs the net group command to list accounts on the system.[10]

Comnie

Comnie uses the net user command.[21]

Duqu

The discovery modules used with Duqu can collect information on accounts and permissions.[8]

Elise

Elise executes net user after initial communication is made to the remote server.[24]

Empire

Empire can acquire local and domain user account information.[6]

Epic

Epic gathers a list of all user accounts, privilege classes, and time of last logon.[17]

GeminiDuke

GeminiDuke collects information on local user accounts from the victim.[20]

InvisiMole

InvisiMole has a command to list account information on the victim’s machine.[13]

Kazuar

Kazuar gathers information on local groups and members on the victim’s machine.[11]

Ke3chang

Ke3chang performs account discovery using commands such as net localgroup administrators and net group "REDACTED" /domain on specific permissions groups.[36]

Kwampirs

Kwampirs collects a list of accounts with the command net users.[15]

Mis-Type

Mis-Type may create a file containing the results of the command cmd.exe /c net user {{Username}}.[9]

MURKYTOP

MURKYTOP has the capability to retrieve information about users on remote hosts.[12]

Net

Commands under net user can be used in Net to gather information about and manipulate user accounts.[2]

OilRig

OilRig has run net user, net user /domain, net group "domain admins" /domain, and net group "Exchange Trusted Subsystem" /domain to get account listings on a victim.[37]

OSInfo

OSInfo enumerates local and domain users[28]

Pony

Pony has used the NetUserEnum function to enumerate local accounts.[30]

Poseidon Group

Poseidon Group searches for administrator accounts on both the local victim machine and the network.[38]

PoshC2

PoshC2 can enumerate local and domain user account information.[7]

PowerSploit

PowerSploit's Get-ProcessTokenGroup Privesc-PowerUp module can enumerate all SIDs associated with its current token.[3][4]

POWERSTATS

POWERSTATS can retrieve usernames from compromised hosts.[16]

PUNCHBUGGY

PUNCHBUGGY can gather user names.[26]

Pupy

Pupy uses PowerView and Pywerview to perform discovery commands such as net user, net group, net local group, etc.[5]

RATANKBA

RATANKBA uses the net user command.[18]

Remsec

Remsec can obtain a list of users.[25]

S-Type

S-Type runs the command net user on a victim. S-Type also runs tests to determine the privilege level of the compromised user.[9]

SHOTPUT

SHOTPUT has a command to retrieve information about connected users.[14]

Threat Group-3390

Threat Group-3390 has used net user to conduct internal discovery of systems.[32]

TrickBot

TrickBot collects the users of the system.[22][23]

Turla

Turla has used net user to enumerate local accounts on the system.[39]

USBferry

USBferry can use net user to gather information about local accounts.[29]

Valak

Valak has the ability to enumerate local admin accounts.[31]

Mitigations

Mitigation Description
Operating System Configuration

Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names. The Registry key is located at HKLM\ SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators. It can be disabled through GPO: Computer Configuration > [Policies] > Administrative Templates > Windows Components > Credential User Interface: Enumerate administrator accounts on elevation.[1]

Detection

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

References

  1. UCF. (n.d.). The system must require username and password to elevate a running application.. Retrieved December 18, 2017.
  2. Savill, J. (1999, March 4). Net.exe reference. Retrieved September 22, 2015.
  3. PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.
  4. PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.
  5. Nicolas Verdier. (n.d.). Retrieved January 29, 2018.
  6. Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.
  7. Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.
  8. Symantec Security Response. (2011, November). W32.Duqu: The precursor to the next Stuxnet. Retrieved September 17, 2015.
  9. Gross, J. (2016, February 23). Operation Dust Storm. Retrieved September 19, 2017.
  10. GovCERT. (2016, May 23). Technical Report about the Espionage Case at RUAG. Retrieved November 7, 2018.
  11. Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.
  12. FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.
  13. Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.
  14. Falcone, R. and Wartell, R.. (2015, July 27). Observations on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload. Retrieved January 22, 2016.
  15. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
  16. Singh, S. et al.. (2018, March 13). Iranian Threat Group Updates Tactics, Techniques and Procedures in Spear Phishing Campaign. Retrieved April 11, 2018.
  17. Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.
  18. Trend Micro. (2017, February 27). RATANKBA: Delving into Large-scale Watering Holes against Enterprises. Retrieved May 22, 2018.
  19. The DigiTrust Group. (2017, January 12). The Rise of Agent Tesla. Retrieved November 5, 2018.
  20. F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.
  1. Grunzweig, J. (2018, January 31). Comnie Continues to Target Organizations in East Asia. Retrieved June 7, 2018.
  2. Salinas, M., Holguin, J. (2017, June). Evolution of Trickbot. Retrieved July 31, 2018.
  3. Anthony, N., Pascual, C.. (2018, November 1). Trickbot Shows Off New Trick: Password Grabber Module. Retrieved November 16, 2018.
  4. Falcone, R., et al.. (2015, June 16). Operation Lotus Blossom. Retrieved February 15, 2016.
  5. Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.
  6. Gorelik, M.. (2019, June 10). SECURITY ALERT: FIN8 IS BACK IN BUSINESS, TARGETING THE HOSPITALITY INDUSTRY. Retrieved June 13, 2019.
  7. Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.
  8. Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.
  9. Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.
  10. hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.
  11. Salem, E. et al. (2020, May 28). VALAK: MORE THAN MEETS THE EYE . Retrieved June 19, 2020.
  12. Counter Threat Unit Research Team. (2017, June 27). BRONZE UNION Cyberespionage Persists Despite Disclosures. Retrieved July 13, 2017.
  13. FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved December 4, 2015.
  14. Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.
  15. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
  16. Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.
  17. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.
  18. Kaspersky Lab's Global Research and Analysis Team. (2016, February 9). Poseidon Group: a Targeted Attack Boutique specializing in global cyber-espionage. Retrieved March 16, 2016.
  19. Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.